EUVD-2026-88959
GHSA-f6f2-q98f-fjrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed portal endpoint
-
ExploitRequest ACL-unconstrained function
-
ExecutionServer returns sensitive data
-
ImpactHarvest disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires network reachability to a deployed DetaWix Mobile Web Portal instance running a version before v1.0.19. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special configuration is stated as necessary - the flaw is that certain functionality is not properly constrained by ACLs, so requesting the affected endpoint discloses sensitive information. The principal limiting factor is exposure and prevalence: this is a single vendor's automotive-trading portal with a small install base, so realistic risk is confined to organizations actually running this product internet-facing. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes a network-reachable, unauthenticated, low-complexity confidentiality-only flaw - sensitive data exposure with no integrity or availability impact, consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data) combined with the description's 'functionality not properly constrained by ACLs.' Exploitation status: no public exploit identified at time of analysis - there is no KEV listing, no EPSS score, and no POC referenced; the only source is the TR-CERT advisory. This means the 7.5 base score reflects intrinsic exposure rather than demonstrated real-world exploitation. The dominant risk-reducing factor is prevalence, not severity: DetaWix Mobile Web Portal is a single Turkish company's product with a very small deployment footprint, so despite the unauthenticated network vector, real-world attack surface is narrow. Net: technically a genuine unauthenticated data-disclosure issue that a defender running this specific portal should patch, but low aggregate priority given the niche product and absence of any exploitation signal. Missing data to note: no EPSS/KEV/POC available, and the CWE-201 label plus 'ACL' phrasing leaves ambiguity over whether the leak is a missing authorization check or over-broad data returned in responses - verify against the TR-CERT advisory. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends requests to an exposed DetaWix Mobile Web Portal endpoint that is not properly constrained by access-control lists, and the portal returns sensitive information in its responses. No user interaction, credentials, or special configuration is required per the CVSS vector, but no public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Sensitive information disclosure in DetaWix Mobile Web Portal versions before v1.0.19 allows unauthenticated remote attackers to retrieve data because the application fails to properly constrain access to certain functionality (CWE-201). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a high-confidentiality-impact flaw requiring no authentication or user interaction, making any internet-facing instance a potential target. However, no public exploit code or active exploitation has been identified at time of analysis (no KEV, no POC, no EPSS), and the product's limited install base confines realistic risk to organizations actually running this portal.
RemediationAI
Upgrade DetaWix Mobile Web Portal to v1.0.19 or later; the CVE description indicates that the vulnerability exists in versions before v1.0.19, making v1.0.19 the first fixed release. Consult the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1210) for any additional vendor guidance. If immediate upgrade is not feasible, restrict network access to the portal to trusted internal networks or VPNs, because the flaw requires network reachability (AV:N) and no authentication (PR:N). Blocking external access to the vulnerable endpoint-if identifiable-would prevent exploitation, though it may interrupt mobile user access. Additionally, deploy a reverse proxy or web application firewall (WAF) with rules to detect and block anomalous requests to the affected functionality, but note that WAFs may not fully mitigate ACL bypass if the endpoint is not well characterized. Monitor logs for unusual data retrieval patterns as a detective control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), which occurs when an application inadvertently includes sensitive information in outbound data-such as HTTP responses-that should not be exposed. Combined with the description's 'functionality not properly constrained by ACLs,' this indicates that an endpoint intended to be restricted is accessible without proper authorization checks, allowing an attacker to retrieve data that should be protected by access controls. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-reachable, requires no authentication or user interaction, and results only in high confidentiality impact-no integrity or availability impact. The affected product is identified by CPE cpe:2.3:a:parla_auto_automotive_trading_limited_company:detawix_mobile_web_portal, spanning all versions before v1.0.19. The TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1210) is the sole public reference.
Know when Detawix Mobile Web Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network access to an endpoint not constrained by ACLs yields sensitive-data disclosure only, so PR:N/AC:L with C:H and I/A:N.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects DetaWix Mobile Web Portal: before v1.0.19.
Executive ViewAI
DetaWix Mobile Web Portal deployments running versions older than v1.0.19 expose sensitive data to anyone on the internet without credentials or user interaction, meaning the confidentiality of information held in or served by the portal is at risk wherever the product is reachable externally. Leadership should care because the exposure is silent and remote - it does not require an insider, a stolen password, or a user to click anything - so any internet-facing instance represents an unmanaged disclosure path for potentially regulated or business-critical data. Risk, however, is bounded to organizations that actually operate this portal, and no public exploit or active exploitation has been identified at time of analysis, making this a contained exposure that should be remediated through exposure reduction and vendor follow-up rather than treated as an emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: remove the portal from direct internet exposure and require VPN or authenticated reverse-proxy access; restrict reachability with firewall allowlists and network segmentation; deploy WAF rules or gateway controls to block unauthenticated access to the portal's data-retrieval functionality; enable enhanced access and query logging and monitor for anomalous or bulk data retrieval; limit the sensitivity and volume of data served or cached by the portal; and confirm remediation timelines with the vendor for the v1.0.19 release referenced in the advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB