Ulakpdf
Monthly
Authentication bypass in TÜBİTAK ULAKBİM's UlakPDF allows remote unauthenticated attackers to reach functionality or data that should be protected by authorization checks, affecting builds through 09092026. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) indicates exploitation needs no credentials and no user interaction, but the High attack complexity means a non-trivial precondition - such as a specific request/parameter combination, a valid resource identifier, or a particular application state that causes the authorization decision to be evaluated incorrectly (CWE-863) - must be satisfied, which reduces reliability. Risk assessment: this is a genuinely notable authorization flaw but not a top-tier emergency; no confirmed actively exploited (CISA KEV) status and no public exploit identified at time of analysis, and the product's limited real-world footprint narrows targeting opportunity.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.
Authentication bypass in TÜBİTAK ULAKBİM's UlakPDF allows remote unauthenticated attackers to reach functionality or data that should be protected by authorization checks, affecting builds through 09092026. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) indicates exploitation needs no credentials and no user interaction, but the High attack complexity means a non-trivial precondition - such as a specific request/parameter combination, a valid resource identifier, or a particular application state that causes the authorization decision to be evaluated incorrectly (CWE-863) - must be satisfied, which reduces reliability. Risk assessment: this is a genuinely notable authorization flaw but not a top-tier emergency; no confirmed actively exploited (CISA KEV) status and no public exploit identified at time of analysis, and the product's limited real-world footprint narrows targeting opportunity.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.