EUVD-2026-91567
GHSA-h7qw-2qfr-8h7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitEnumerate protected resource identifiers
-
ExecutionSend request bypassing missing authorization check
-
ImpactRetrieve unauthorized confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on the AVEZ Electronics Learning Management System with at least low-privilege access (CVSS PR:L); it is not exploitable by fully unauthenticated outsiders. The core condition is the application's incorrectly configured access-control levels - endpoints or objects that fail to enforce per-user authorization - so an authenticated user can reach resources beyond their privilege level. Limiting factors: an attacker must first obtain or register a low-privileged account, and the product must be network-reachable; impact is limited to confidential data disclosure (no integrity or availability effect). Affected scope is any LMS instance at or before the 2026-09-18 version baseline. |
| Impact | This is a moderate-severity, authorization flaw (CWE-862, Missing Authorization) in a niche vendor's Learning Management System. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable issue that is low-complexity but requires an authenticated low-privileged account (PR:L) - so it is not an unauthenticated internet-wide exposure. Impact is confined to confidentiality (C:H/I:N/A:N): an authenticated user can read data they should not, with no data tampering or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization - the status is 'no public exploit identified at time of analysis.' Weighing these signals together, this is a real but second-tier priority: genuine data-confidentiality exposure for any deployment, but the low real-world footprint of the product and the authentication requirement temper widespread risk. It should be patched promptly where the product is deployed, but it is not a drop-everything emergency absent exploitation signals. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account (e.g., a student or basic user) on the AVEZ LMS sends crafted requests to endpoints or object identifiers that lack proper authorization checks, retrieving other users' or administrators' confidential records. Because attack complexity is low and the vector is network-based, exploitation requires only valid credentials and knowledge of the vulnerable endpoint. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Missing authorization controls in AVEZ Electronics Communication Training and Consultancy Trade Inc.'s Learning Management System (LMS) allow an authenticated low-privilege user to reach resources and records beyond their assigned privilege level, resulting in disclosure of confidential data. The flaw (CWE-862) is remotely exploitable over the network with low attack complexity, but requires a valid authenticated session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so fully unauthenticated outsiders cannot trigger it directly; impact is confined to confidentiality, with no integrity or availability effect. All LMS instances at or before the 2026-09-18 version baseline are in scope, and no public exploit code has been identified at time of analysis, though no vendor-released patch has been confirmed either.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must initially rely on compensating controls while the vendor is engaged; monitor the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1242 for an updated version and apply it as soon as it is published. Until then, restrict network exposure of the LMS to trusted internal ranges or place it behind a VPN or reverse-proxy allowlist so that only known users can reach it - this reduces the pool of attackers who can obtain a low-privileged account, at the cost of breaking access for remote or mobile learners. Disable self-service account registration and enforce manual, administrator-approved provisioning to raise the cost of acquiring the low-privilege session the exploit requires. Conduct an authorization audit of every endpoint, API route, and object reference, adding explicit server-side role and ownership checks (deny-by-default), since the underlying CWE-862 defect is application-level and will persist until code is corrected. Enable detailed access logging and alerting on authenticated users requesting records, courses, or user IDs outside their assigned scope, which can detect exploitation attempts but does not prevent them. Note that none of these controls eliminates the flaw itself, and each carries operational trade-offs, so the vendor fix remains the only complete resolution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic broken access control defect in the CWE-862 (Missing Authorization) class, sometimes described as exploiting incorrectly configured access control security levels. Rather than a memory-safety or injection flaw, the root cause is that the LMS fails to perform a server-side authorization check on one or more endpoints, controllers, or object references before returning data to the caller. Because the application authenticates the user but does not verify that the user is entitled to the requested object or function, any holder of a low-privileged account - including one obtained through self-registration where enabled - can enumerate or directly request privileged content. The CPE string cpe:2.3:a:avez_electronics_communication_training_and_consultancy_trade_inc.:learning_management_system_(lms):* identifies the product with a wildcard version, meaning the vendor's LMS is treated as affected across versions up to the 2026-09-18 baseline. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network reachability, low complexity, and a low-privilege prerequisite, with high confidentiality impact and no scope change. Typical data exposed in an LMS context includes student records, grades, enrollment data, course materials, and administrative metadata.
Know when Learning Management System Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable missing-authorization flaw needing a low-privileged account (PR:L), low complexity, yielding confidential data disclosure only (C:H, I/A:N).
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Learning Management System (LMS): through 2026-09-18.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB