{"api_version":"1","generated_at":"2026-07-22T12:30:42+00:00","cve":"CVE-2026-2406","urls":{"html":"https://cve.report/CVE-2026-2406","api":"https://cve.report/api/cve/CVE-2026-2406.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-2406","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-2406"},"summary":{"title":"IDOR in Universe Software's Online Registration and Workflow Management System","description":"Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.\n\nThis issue affects Online Registration and Workflow Management System: through 12022026.","state":"PUBLISHED","assigner":"TR-CERT","published_at":"2026-07-22 09:16:28","updated_at":"2026-07-22 09:16:28"},"problem_types":["CWE-639","CWE-639 CWE-639 Authorization bypass through User-Controlled key"],"metrics":[{"version":"3.1","source":"iletisim@usom.gov.tr","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594","name":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594","refsource":"iletisim@usom.gov.tr","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2406","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2406","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Universe Software Computer Marketing Trade and Industry Inc.","product":"Online Registration and Workflow Management System","version":"affected 12022026 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Can Nesimi ARI","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Online Registration and Workflow Management System","vendor":"Universe Software Computer Marketing Trade and Industry Inc.","versions":[{"lessThanOrEqual":"12022026","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Can Nesimi ARI"}],"datePublic":"2026-07-22T08:43:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.<p>This issue affects Online Registration and Workflow Management System: through 12022026.</p>"}],"value":"Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.\n\nThis issue affects Online Registration and Workflow Management System: through 12022026."}],"impacts":[{"capecId":"CAPEC-22","descriptions":[{"lang":"en","value":"CAPEC-22 Exploiting Trust in Client"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization bypass through User-Controlled key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-22T08:51:21.311Z","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","shortName":"TR-CERT"},"references":[{"tags":["government-resource"],"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594"}],"source":{"advisory":"TR-26-0594","defect":["TR-26-0594"],"discovery":"UNKNOWN"},"title":"IDOR in Universe Software's Online Registration and Workflow Management System","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","assignerShortName":"TR-CERT","cveId":"CVE-2026-2406","datePublished":"2026-07-22T08:51:21.311Z","dateReserved":"2026-02-12T13:25:58.515Z","dateUpdated":"2026-07-22T08:51:21.311Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-22 09:16:28","lastModifiedDate":"2026-07-22 09:16:28","problem_types":["CWE-639","CWE-639 CWE-639 Authorization bypass through User-Controlled key"],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"2406","Ordinal":"1","Title":"IDOR in Universe Software's Online Registration and Workflow Man","CVE":"CVE-2026-2406","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"2406","Ordinal":"1","NoteData":"Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.\n\nThis issue affects Online Registration and Workflow Management System: through 12022026.","Type":"Description","Title":"IDOR in Universe Software's Online Registration and Workflow Man"}]}}}