EUVD-2026-95031
GHSA-27h6-vpmh-cv9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege ALMS account
-
ExploitInvoke endpoint lacking ACL enforcement
-
ExecutionAccess functionality/data outside user scope
-
ImpactExfiltrate confidential information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on an Advancity ALMS Cloud tenant (CVSS PR:L); it is not exploitable by fully unauthenticated attackers. Given the account, the attacker reaches application functionality that is not properly constrained by access-control lists (CWE-862), requiring no user interaction (UI:N) and no special non-default configuration identified in the description. The affected scope is every deployment of Advancity ALMS Cloud up to and including the 2026-10-08 build. The main limiting factor is the need for low-privilege credentials; the impact is confined to confidentiality (C:H, I:N, A:N), so it enables unauthorized data access but not data modification or service disruption. |
| Impact | This is a moderate-priority, authenticated information-disclosure flaw rather than a critical remote-takeover issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation that nonetheless requires low-privilege authentication (PR:L) and yields high confidentiality impact only, with no integrity or availability impact. In practice this means an already-authenticated user can reach functionality/data not properly constrained by ACLs (CWE-862, missing authorization). No exploitation-probability data is available: EPSS is not provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The signals are internally consistent (authenticated access + confidentiality-only impact), so there is no CVSS-versus-description conflict to flag. The primary caveat is sourcing: this was reported by TR-CERT and the vendor explicitly did not respond to disclosure, so there is no vendor confirmation or patch, which raises remediation uncertainty even though the technical severity is only medium. |
| Exploit ScenarioDerived | A user who holds any valid low-privilege account on an Advancity ALMS Cloud instance invokes an application function or endpoint that is missing a proper authorization check, retrieving data or using functionality belonging to other users or higher privilege levels. Because the CVSS vector is AV:N/AC:L/PR:L, the request can be made remotely over the network with low complexity once authenticated. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Advancity ALMS Cloud (Caz Informatics Services Trade Inc.) fails to enforce proper access-control lists, letting an authenticated low-privilege user reach functionality and data that should be restricted to higher-privileged roles. Exploitation requires a valid session on a tenant (CVSS PR:L) but no user interaction, and all deployments up to and including the 2026-10-08 build are affected; the resulting impact is confidentiality-only (C:H/I:N/A:N), enabling unauthorized data disclosure rather than modification or disruption. No public exploit code was identified at time of analysis, and because the vendor did not respond to the coordinated disclosure, no fixed version has been published.
RemediationAI
No vendor-released patch was identified at time of analysis: the vendor was contacted early about the disclosure and did not respond, and the only published reference is the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1276, which should be monitored for an updated build. Until a fix ships, treat this as an authorization-layer problem to be contained externally. Practical compensating controls: (1) Inventory and aggressively prune tenant accounts, removing dormant, guest, and over-privileged roles so that the number of principals who can reach the vulnerable functionality is minimized - trade-off is reduced operational flexibility for legitimate users; (2) enforce server-side authorization at a reverse proxy or API gateway by allow-listing the specific URL/parameter patterns each role legitimately needs and denying everything else, accepting that this requires reverse-engineering the app's route map and can break legitimate workflows if allow-lists are too tight; (3) instrument the application and gateway logs for successful calls to high-value endpoints by low-privilege sessions and alert on them, noting this is detection rather than prevention and will not stop a slow, low-volume attacker; (4) if the tenant exposes administrative or reporting interfaces that low-privilege users do not need, block those paths at the perimeter and restrict them to trusted admin source ranges. Note that the CVSS vector (PR:L, C:H) means the boundary cannot be closed by disabling remote access entirely - the controls above only reduce the attack surface. If the vendor does eventually publish a fixed build, upgrading past the 2026-10-08 release is the only complete remedy and should be prioritized over all workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): the application performs authentication but does not verify that the requesting principal is authorized for the specific function or object being accessed, so ACL checks are absent or incomplete on one or more endpoints. The affected component is the cloud-hosted Advancity ALMS (a learning management / training platform) delivered as SaaS, identified by CPE cpe:2.3:a:caz_informatics_services_trade_inc.:advancity_alms_cloud:*:*:*:*:*:*:*:*, with all builds through 2026-10-08 flagged by EUVD (EUVD-2026-95031). The CVSS vector AV:N/AC:L/PR:L/UI:N indicates the endpoint is network-reachable, requires low privileges and no user interaction, and the scope is unchanged, which is consistent with a server-side authorization gap rather than a memory-safety or injection defect. Because the failing control is authorization rather than authentication, an attacker who already holds any legitimate tenant account (for example a low-privilege learner or guest role) can drive privileged application functionality directly instead of escalating credentials. The associated tags ('Authentication Bypass') describe the practical effect of reaching restricted functionality, not a credential-forgery primitive.
Know when Advancity Alms Cloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated low-privilege user reaches un-ACL'd functionality over the network with low complexity (PR:L, AC:L, AV:N); impact is confidentiality-only (C:H, I:N, A:N), scope unchanged.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB