{"id":"CVE-2026-19083","published":"2026-10-08T12:17:17.500","lastModified":"2026-10-08T20:09:14.010","description":"Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects OctoCloud: from 1.12.06 before 1.12.07.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1272","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthorized access to functionality not properly constrained by ACLs, enabling potential data theft, manipulation, or system compromise.","exploitability":"Exploitation requires user-controlled input to bypass authorization, which is moderately difficult given the need for specific input to trigger the vulnerability.","blast_radius":"If exploited, this could lead to significant data breaches or system compromise affecting users and potentially impacting business operations.","remediation":"Upgrade to OctoCloud 1.12.07 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","acl","vulnerability","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:52.970Z"}}