CVEsNetiket Information TechnologiesCVE-2026-16309Published Aug 18, 12:57 · Updated Aug 18, 16:02 UTC
5.3
MediumCVSS 3.1 · from TR-CERT
CVE-2026-16309
IDOR in Netiket Information Technologies' EdoWEB
EdoWEB · Authorization bypass via user key · CWE-639AffectedEdoWEB
FixUpdate to 780-g7 or newer
PublishedAug 18, 12:57 · TR-CERT
ScoredAug 18 · 5.3 · TR-CERT
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data. CVSS impact.
Description
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
From TR-CERT
Affected and fixed versions
ProductAffectedFixed inEdoWEBbefore 780-g7780-g7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known