{"id":"CVE-2026-11838","state":"PUBLISHED","title":"Improper Authorization in Yordam Informatics' Library Reservation System","description":"Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation.\n\nThis issue affects Library Reservation System: before v22.2.","publishedAt":"2026-09-09T09:14:06.327Z","updatedAt":"2026-09-09T12:51:23.389Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"TR-CERT"},"assigner":"TR-CERT","products":["Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System"],"affected":[{"vendor":"Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.","product":"Library Reservation System","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v22.2","versionType":"custom"}]}],"references":["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1035"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11838.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11838","state":"PUBLISHED","datePublished":"2026-09-09T09:14:06.327Z","dateUpdated":"2026-09-09T12:51:23.389Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2026-06-10T06:16:48.866Z"},"containers":{"cna":{"title":"Improper Authorization in Yordam Informatics' Library Reservation System","descriptions":[{"lang":"en","value":"Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation.\n\nThis issue affects Library Reservation System: before v22.2."}],"affected":[{"vendor":"Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.","product":"Library Reservation System","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v22.2","versionType":"custom"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1035","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-09-09T09:14:06.327Z"},"datePublic":"2026-09-09T08:53:00.000Z","impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153 Input Data Manipulation"}]}],"credits":[{"lang":"en","value":"Çınar FİDANBOY","type":"finder"}],"source":{"defect":["TR-26-1035"],"advisory":"TR-26-1035","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-09T12:50:57.992175Z","id":"CVE-2026-11838","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-09T12:51:23.389Z"}}]}}}