{"affected":[{"defaultStatus":"unaffected","product":"EdoWEB","source":"CNA: TR-CERT","vendor":"Netiket Information Technologies","versions":[{"lessThan":"780-g7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-16307","cwes":["CWE-639"],"description":"Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects EdoWEB: before 780-g7.","epss":{"date":"2026-11-04","percentile":0.08856,"score":0.00191},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: TR-CERT","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793824111567,"publishedAt":1793107382346,"references":[{"source":"CNA: TR-CERT","tags":["government-resource"],"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1409"}],"remediation":[],"revision":"74b121c182d3515c7d436e54aee9c7aa3b378ee60d8d22ba88d35abde881b550","sources":[{"modifiedAt":1793824111567,"name":"CNA: TR-CERT","retrievedAt":1793826749863,"url":"https://www.cve.org/CVERecord?id=CVE-2026-16307"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793826762278,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16307"}],"ssvc":{"assessedAt":1793817767781,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"IDOR in Netiket Information Technologies' EdoWEB","updatedAt":1793826762278}