Enocta Platform EUVD-2026-88241

Requires a valid authenticated low-privilege account on the Enocta Platform (PR:L) and the ability to observe and manipulate a user-controlled resource identifier (user ID, enrollment/record key, or similar trusted identifier) in application requests. No victim user interaction is needed (UI:N) and the attack is fully remote (AV:N/AC:L). The primary limiting factor is the authentication requirement - the attacker must first obtain platform access (e.g., a learner or self-registered account) - and exploitation is confined to organizations actually deploying the Enocta Platform, a regional Turkish e-learning product.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High) describes a network-reachable, low-complexity IDOR requiring only an authenticated low-privilege account, with high confidentiality and integrity impact but no availability impact - consistent with CWE-639, where a user-controlled identifier lets one authenticated user reach another's resources. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.1 rating is a theoretical-severity signal, not a demonstrated-exploitation signal. The realistic priority is moderated by two facts: exploitation requires a valid low-privilege account (PR:L), and the product is a regional Turkish e-learning platform rather than ubiquitous infrastructure. Net assessment: a genuinely impactful bug for any organization actually running the Enocta Platform (multi-tenant PII/course-data exposure and tampering), but not a broad, internet-scale emergency. Note the tag 'Authentication Bypass' is imprecise - CWE-639 is an authorization (access-control) bypass, not an authentication bypass; the attacker is already authenticated. Affected-version data is coarse ('through 2026-09-28') with no confirmed fixed version, so patch status should be verified with the vendor/TR-CERT advisory.

An attacker registers or already holds a legitimate low-privilege Enocta account (e.g., a learner), then intercepts an application request and substitutes another user's object identifier (such as a user ID, enrollment ID, or record key) to read or modify resources belonging to other users or tenants. Because the vector is AV:N/AC:L/PR:L/UI:N, this is a straightforward remote request-manipulation attack requiring no victim interaction and only basic tooling. No public POC was provided at time of analysis.