EUVD-2026-98357
GHSA-f47j-j9pr-8973
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess ticketing platform over network
-
ExploitIntercept request bypassing client-side validation
-
ExecutionSubmit forged state-changing request
-
ImpactAlter server-side ticket/booking state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | The core prerequisite is architectural, not configuration-based: the Biletiva Ticketing Platform enforces one or more security/authorization checks only in the client (CWE-602), so an attacker who sends requests directly - bypassing the client-side logic - can manipulate server-side state. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required; exploitation works against the platform over the network using ordinary request-tampering. Limiting factors are narrow: the attacker needs network reachability to the platform and knowledge of the request structure the client normally governs, and real-world exposure is constrained mainly by the product's limited deployment footprint rather than by any technical barrier. |
| Impact | Signals point to a genuinely high-impact but low-visibility issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely exploitable, low-complexity flaw requiring no authentication or user interaction, scored 8.6, with the weight on integrity (I:H) consistent with CWE-602 'Client-Side Enforcement of Server-Side Security' and the stated 'Manipulating State' impact - an attacker bypasses controls that are only enforced in the client. However, no EPSS probability, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. This creates a classic high-CVSS/unknown-real-world-risk tension: the vulnerability class is trivially exploitable in principle (modify a request the client was trusted to validate), but the affected product is a niche Turkish ticketing platform, so practical exposure is likely narrow and opportunistic rather than mass-exploited. CONFLICT TO NOTE: the input 'Information Disclosure' tag emphasizes confidentiality, whereas the CVSS vector and description emphasize integrity/state manipulation (I:H vs only C:L) - treat this as primarily a state-manipulation/authorization-bypass issue, not a data-leak issue, and verify the exact impact with the TR-CERT advisory. |
| Exploit ScenarioDerived | An attacker interacts with the Biletiva Ticketing Platform over the network and intercepts or crafts requests that the application expected the client to validate, bypassing client-side checks to manipulate server-side state (for example altering ticket, pricing, or booking status). Because the vector is AV:N/AC:L/PR:N/UI:N, this requires no authentication, no victim interaction, and only standard HTTP tampering tools. No public exploit code is identified at time of analysis, but CWE-602 flaws are straightforward to exploit with a proxy such as Burp Suite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with confirming availability of an updated Biletiva build through Divasoft and monitoring the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1309 for a fixed release; because the CVE lists all versions through 2026-07-23 as affected, upgrading to a build later than that date is the target once the vendor publishes one. Until then, the most effective compensating control is to re-implement the missing authorization and validation checks server-side - treat every state-changing endpoint as untrusted and re-verify user identity, object ownership, permitted state transitions, and input ranges in the backend, accepting that this is development effort rather than a drop-in fix. In parallel, restrict network reachability to the ticketing platform so that only expected clients, IP ranges, or a reverse proxy/gateway can reach the application endpoints, which shrinks the attack surface but will break legitimate off-network access for staff and partners. A WAF or API gateway rule that rejects malformed or unexpected parameter combinations on ticketing and order endpoints can block obvious tampering, with the trade-off that such rules are signature-based, easily evaded by parameter restructuring, and prone to false positives against legitimate client traffic. Enforce server-side session and role checks on every request (rather than trusting client-carried role or price fields), and add alerting on anomalous order, pricing, or seat-state change patterns so that any manipulation is at least detected; note that none of these controls removes the underlying client-side-enforcement flaw and all remain in place until a fixed version is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-602, Client-Side Enforcement of Server-Side Security. In the Biletiva Ticketing Platform, one or more security decisions - authorization for a state-changing action, validation of user-supplied values, or enforcement of business rules governing ticketing operations - are performed only in JavaScript running in the user's browser. Because a client is fully under attacker control, those checks carry no security weight: an attacker can invoke the same backend endpoints directly with crafted parameters, skipping the client logic entirely, and the server will accept and persist the change. Ticketing systems are particularly exposed to this pattern because seat availability, price calculation, reservation ownership, and order state transitions are frequently computed in the UI layer for responsiveness. The only CPE supplied is a wildcard (cpe:2.3:a:divasoft_software_and_e-commerce_inc.:biletiva_ticketing_platform:*:*:*:*:*:*:*:*), so no fixed version boundary is enumerated; the vendor data states all versions through 2026-07-23 are affected. No EPSS score, KEV listing, or public PoC was included in the reporting, so the practical risk is driven by exposure of the platform on the network and by how much server-side state a given unchecked request can alter.
Know when Biletiva Ticketing Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Client-side-only enforcement lets an unauthenticated remote attacker tamper with requests (AV:N/AC:L/PR:N/UI:N); primary impact is state manipulation (I:H) with limited confidentiality/availability effects (C:L/A:L).
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.
This issue affects Biletiva Ticketing Platform: through 2026-07-23.
Executive ViewAI
CVE-2026-13138 exposes the Biletiva Ticketing Platform to unauthenticated attackers who can manipulate ticket, order, and pricing records because critical authorization checks are enforced only in the user's browser. Any internet-facing deployment is potentially reachable without credentials or user interaction, making revenue integrity, order accuracy, and customer trust the primary exposure rather than data theft or downtime. Leadership should treat this as a revenue-assurance and transactional-integrity risk and note that no vendor patch is currently available, so protection depends on interim controls and monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce all authorization, pricing, and order-state validation server-side so client input is never trusted; block or strip client-supplied price, discount, and privilege fields at the API gateway or WAF; restrict exposure of Biletiva deployments to trusted networks, VPN, or IP allowlists; add rate limiting and anomaly alerting on ticket, order, and pricing mutations; and require manual review or reconciliation of high-value transactions until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB