CVE-2026-2347

Full vulnerability record from the local CVENow database.

Description

Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. This issue affects E-Commerce Website: before 4.5.001.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-05-14 10:16:19.203000

Last modified

2026-10-26 14:10:00.130000

View original CVE JSON

{
  "id": "CVE-2026-2347",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T10:16:19.203",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.\n\nThis issue affects E-Commerce Website: before 4.5.001."
    },
    {
      "lang": "es",
      "value": "Omisión de autorización a través de una vulnerabilidad de clave controlada por el usuario en el sitio web de comercio electrónico de Akilli Commerce Software Technologies Ltd. Co. permite el secuestro de sesión.\n\nEste problema afecta al sitio web de comercio electrónico: anterior a 4.5.001."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Akilli Commerce Software Technologies Ltd. Co.",
          "product": "E-Commerce Website",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.5.001",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T17:47:24.564421Z",
          "id": "CVE-2026-2347",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0222",
      "source": "[email protected]"
    }
  ]
}