CVE-2026-23843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.842Z", "datePublished": "2026-01-19T18:42:56.765Z", "dateUpdated": "2026-01-20T20:05:43.380Z"}, "containers": {"cna": {"title": "teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sibercii6-crypto/teklifolustur_app/security/advisories/GHSA-6h9r-mmg3-cg7m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sibercii6-crypto/teklifolustur_app/security/advisories/GHSA-6h9r-mmg3-cg7m"}, {"name": "https://github.com/sibercii6-crypto/teklifolustur_app/commit/dd082a134a225b8dcd401b6224eead4fb183ea1c", "tags": ["x_refsource_MISC"], "url": "https://github.com/sibercii6-crypto/teklifolustur_app/commit/dd082a134a225b8dcd401b6224eead4fb183ea1c"}], "affected": [{"vendor": "sibercii6-crypto", "product": "teklifolustur_app", "versions": [{"version": "< dd082a134a225b8dcd401b6224eead4fb183ea1c", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:42:56.765Z"}, "descriptions": [{"lang": "en", "value": "teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, an Insecure Direct Object Reference (IDOR) vulnerability exists in the offer view functionality. Authenticated users can manipulate the offer_id parameter to access offers belonging to other users. The issue is caused by missing authorization checks ensuring that the requested offer belonged to the currently authenticated user. Commit dd082a134a225b8dcd401b6224eead4fb183ea1c contains a patch."}], "source": {"advisory": "GHSA-6h9r-mmg3-cg7m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T19:37:12.620630Z", "id": "CVE-2026-23843", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:05:43.380Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T19:37:12.620630Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:37:13.692Z"}}], "cna": {"title": "teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers", "source": {"advisory": "GHSA-6h9r-mmg3-cg7m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sibercii6-crypto", "product": "teklifolustur_app", "versions": [{"status": "affected", "version": "< dd082a134a225b8dcd401b6224eead4fb183ea1c"}]}], "references": [{"url": "https://github.com/sibercii6-crypto/teklifolustur_app/security/advisories/GHSA-6h9r-mmg3-cg7m", "name": "https://github.com/sibercii6-crypto/teklifolustur_app/security/advisories/GHSA-6h9r-mmg3-cg7m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sibercii6-crypto/teklifolustur_app/commit/dd082a134a225b8dcd401b6224eead4fb183ea1c", "name": "https://github.com/sibercii6-crypto/teklifolustur_app/commit/dd082a134a225b8dcd401b6224eead4fb183ea1c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, an Insecure Direct Object Reference (IDOR) vulnerability exists in the offer view functionality. Authenticated users can manipulate the offer_id parameter to access offers belonging to other users. The issue is caused by missing authorization checks ensuring that the requested offer belonged to the currently authenticated user. Commit dd082a134a225b8dcd401b6224eead4fb183ea1c contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T18:42:56.765Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23843", "state": "PUBLISHED", "dateUpdated": "2026-01-20T20:05:43.380Z", "dateReserved": "2026-01-16T15:46:40.842Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T18:42:56.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "teklifolustur_app", "vendor": "sibercii6-crypto", "versions": [{"status": "affected", "version": "< dd082a134a225b8dcd401b6224eead4fb183ea1c"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, an Insecure Direct Object Reference (IDOR) vulnerability exists in the offer view functionality. Authenticated users can manipulate the offer_id parameter to access offers belonging to other users. The issue is caused by missing authorization checks ensuring that the requested offer belonged to the currently authenticated user. Commit dd082a134a225b8dcd401b6224eead4fb183ea1c contains a patch."}, {"lang": "es", "value": "teklifolustur_app es una aplicaci\u00f3n PHP basada en web que permite a los usuarios crear, gestionar y rastrear cotizaciones para sus clientes. Antes del commit dd082a134a225b8dcd401b6224eead4fb183ea1c, una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) exist\u00eda en la funcionalidad de vista de ofertas. Los usuarios autenticados pod\u00edan manipular el par\u00e1metro offer_id para acceder a ofertas que pertenec\u00edan a otros usuarios. El problema era provocado por la falta de comprobaciones de autorizaci\u00f3n que asegurasen que la oferta solicitada pertenec\u00eda al usuario actualmente autenticado. El commit dd082a134a225b8dcd401b6224eead4fb183ea1c contiene un parche."}], "id": "CVE-2026-23843", "lastModified": "2026-06-17T10:22:11.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23843", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T19:37:12.620630Z", "version": "2.0.3"}}]}, "published": "2026-01-19T19:16:04.660", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sibercii6-crypto/teklifolustur_app/commit/dd082a134a225b8dcd401b6224eead4fb183ea1c"}, {"source": "security-advisories@github.com", "url": "https://github.com/sibercii6-crypto/teklifolustur_app/security/advisories/GHSA-6h9r-mmg3-cg7m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:03:08.179544+00:00", "value": {"mitigation_remediation": ["Apply the security patch from commit dd082a134a225b8dcd401b6224eead4fb183ea1c to the application codebase.", "Deploy the updated version of teklifolustur_app or rebuild the application using the patched source.", "Verify the patch implementation by attempting to access another user\u2019s offer and confirming it is denied or shows an access denied error.", "Enable logging of failed access attempts to detect potential abuse."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access to other users' offers (IDOR)"}, "threat_synthesis": {"affected_systems": "Vendor sibercii6-crypto provides the teklifolustur_app web application. The vulnerability affects the offer view functionality, present in all releases before the patch commit dd082a134a225b8dcd401b6224eead4fb183ea1c. No specific version range is listed, so all instances running the pre\u2011patch source code are potentially vulnerable.", "description_and_impact": "An insecure direct object reference flaw was discovered in teklifolustur_app, a PHP web platform for quote management. Authenticated users can modify the offer_id parameter when viewing offers, bypassing missing authorization checks and retrieving offers that belong to other users. This flaw can expose confidential client data, allow data tampering, and potentially breach privacy requirements, as demonstrated by the CWE-639 classification.", "risk_and_exploitability": "The CVSS v3 score is 7.1, indicating high severity, while the EPSS score is below 1%, suggesting a low exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers must first authenticate to the system and can then manipulate HTTP request parameters to access other users\u2019 offers. The lack of an official workaround implies a direct patch is required, and the low EPSS may reduce the immediacy of exploitation but does not mitigate the confidentiality risk."}}}}, "created": "2026-01-20T08:40:23.670713+00:00", "updated": "2026-04-18T05:15:15.972035+00:00", "vendors": ["sibercii6-crypto", "sibercii6-crypto$PRODUCT$teklifolustur_app"], "weaknesses": ["CWE-639"]}