What is the CVSS score of EUVD-2026-58666?

EUVD-2026-58666 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-58666?

Yes, a patch is available for EUVD-2026-58666. Update the affected software to the latest version immediately.

E-Municipality EUVD-2026-58666

| CVE-2026-1621 MEDIUM

Authentication Bypass by Primary Weakness (CWE-305)

2026-08-14 iletisim@usom.gov.tr

GHSA-pv35-6x7m-m92j

Authentication Bypass

5.3

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication or user interaction; integrity-only impact aligns with partial bypass of authentication enabling limited unauthorized writes, no confidentiality or availability impact observed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 14, 2026 - 15:02 EUVD

Analysis Generated

Aug 14, 2026 - 14:32 vuln.today

DescriptionCVE.org

Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.

This issue affects E-Municipality: from 20251127 before 20260204.

AnalysisAI

E-Municipality by Universal Software Inc. exposes a remotely exploitable authentication bypass via trusted identifier exploitation (CWE-305), affecting all versions from 20251127 up to the patched release 20260204. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can reach the vulnerable authentication layer with no user interaction and no access prerequisites, resulting in limited integrity compromise. Disclosed by Turkey's national CSIRT (USOM), no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

CWE-305 (Authentication Bypass by Primary Weakness) describes a flaw where a system's authentication relies on a primary credential or identifier - such as a session token, cookie value, or user-supplied parameter - that is insufficiently validated or can be forged. E-Municipality is an e-government platform designed for Turkish municipal administrations to deliver public services. The date-stamped versioning scheme (YYYYMMDD) indicates rolling releases; affected versions span 20251127 through 20260203. The vulnerability class suggests the application trusts a client-controllable identifier as proof of authenticated identity, without cryptographic verification or server-side binding, enabling bypass of the primary authentication gate.

RemediationAI

Upgrade E-Municipality to version 20260204 or later, as this release represents the upper patched boundary per the NVD version range data. Reference the USOM security bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0846 for vendor-specific upgrade instructions. If immediate patching cannot be scheduled, restrict network-level access to E-Municipality authentication endpoints via firewall ACLs or a web application firewall (WAF) configured to allowlist only expected client IP ranges - note that for public-facing municipal service portals this may impact citizen accessibility and must be balanced against service availability requirements. Implementing additional server-side session validation and identifier binding as a defense-in-depth measure is advisable even after patching.