CVE-2026-13724

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13724", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-06-29T14:27:22.477Z", "datePublished": "2026-07-20T14:32:09.075Z", "dateUpdated": "2026-07-21T14:56:53.418Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-20T14:32:09.075Z"}, "title": "Business Logic Bypass in Gobito's Corporate Training Management System", "datePublic": "2026-07-20T14:24:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "affected": [{"vendor": "Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co.", "product": "Corporate Training Management System", "versions": [{"status": "affected", "version": "0", "lessThan": "dd1a9df64", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.\n\nThis issue affects Corporate Training Management System: before dd1a9df64.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.<p>This issue affects Corporate Training Management System: before dd1a9df64.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0582", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Ahmet Yasin AKT\u00dcRK", "type": "finder"}], "source": {"defect": ["TR-26-0582"], "advisory": "TR-26-0582", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T13:40:06.627686Z", "id": "CVE-2026-13724", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T14:56:53.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T13:40:06.627686Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T13:40:11.583Z"}}], "cna": {"title": "Business Logic Bypass in Gobito's Corporate Training Management System", "source": {"defect": ["TR-26-0582"], "advisory": "TR-26-0582", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ahmet Yasin AKT\u00dcRK"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co.", "product": "Corporate Training Management System", "versions": [{"status": "affected", "version": "0", "lessThan": "dd1a9df64", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-20T14:24:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0582", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.\n\nThis issue affects Corporate Training Management System: before dd1a9df64.", "supportingMedia": [{"type": "text/html", "value": "Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.<p>This issue affects Corporate Training Management System: before dd1a9df64.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-20T14:32:09.075Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13724", "state": "PUBLISHED", "dateUpdated": "2026-07-21T14:56:53.418Z", "dateReserved": "2026-06-29T14:27:22.477Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-07-20T14:32:09.075Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Corporate Training Management System", "vendor": "Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co.", "versions": [{"lessThan": "dd1a9df64", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.\n\nThis issue affects Corporate Training Management System: before dd1a9df64."}, {"lang": "es", "value": "Vulnerabilidad de seguridad del lado del servidor por imposici\u00f3n del lado del cliente en el Sistema de Gesti\u00f3n de Capacitaci\u00f3n Corporativa de Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. permite la manipulaci\u00f3n de datos de entrada.\n\nEste problema afecta al Sistema de Gesti\u00f3n de Capacitaci\u00f3n Corporativa: antes de dd1a9df64."}], "id": "CVE-2026-13724", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13724", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T13:40:06.627686Z", "version": "2.0.3"}}]}, "published": "2026-07-20T16:16:55.190", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0582"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,dd1a9df64)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Corporate Training Management System", "source": "cna", "vendor": "Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co."}, "product": "corporate_training_management_system", "vendor": "gobito_informatics_technologies"}], "created": "2026-07-21T20:45:03.263787+00:00", "updated": "2026-07-30T19:30:09.702070+00:00", "vendors": ["gobito_informatics_technologies", "gobito_informatics_technologies$PRODUCT$corporate_training_management_system"]}