Vulnerability · Published Jul 22, 2026 · Assigned by TR-CERT

CVE-2026-2406IDOR in Universe Software's Online Registration and Workflow Management System

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Online Registration and Workflow Management System from Universe Software Computer Marketing Trade and Industry Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 69.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through 12022026.

Affected products (as reported)

Vendor	Product	Versions
Universe Software Computer Marketing Trade and Industry Inc.	Online Registration and Workflow Management System	0 – through 12022026

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594 government-resource