CVEsNetiket Information TechnologiesCVE-2026-16307Published Oct 27, 13:23 · Updated Oct 27, 13:23 UTC
4.3
MediumCVSS 3.1 · from TR-CERT
CVE-2026-16307
IDOR in Netiket Information Technologies' EdoWEB
EdoWEB · Authorization bypass via user key · CWE-639AffectedEdoWEB
FixUpdate to 780-g7 or newer
PublishedOct 27, 13:23 · TR-CERT
ScoredOct 27 · 4.3 · TR-CERT
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
From TR-CERT
Affected and fixed versions
ProductAffectedFixed inEdoWEBbefore 780-g7780-g7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known