Mobile App
Monthly
Authorization bypass in Menulux Software Inc. Mobile App (all versions through the 12.05.2026 build) lets remote attackers manipulate a user-controlled key (an Insecure Direct Object Reference, CWE-639) to reach or alter resources belonging to other users, enabling a software integrity attack. TR-CERT rates it CVSS 9.8 with full CIA impact, though the primary documented effect is integrity tampering. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authorization bypass in Menulux Software Inc. Mobile App (all versions through the 12.05.2026 build) lets remote attackers manipulate a user-controlled key (an Insecure Direct Object Reference, CWE-639) to reach or alter resources belonging to other users, enabling a software integrity attack. TR-CERT rates it CVSS 9.8 with full CIA impact, though the primary documented effect is integrity tampering. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.