TI-2026-01307 Aliases CVE-2026-1621 GHSA-pv35-6x7m-m92j

Register Bypass in Universal Sotware's E-Municipality

LOW 30CWE-305Published 2026-08-14 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affects E-Municipality: from 20251127 before 20260204.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00405 34th percentileScored 2026-11-07

Fix Fixed E-Municipality (Universal Software Inc.): 20260204

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Universal Software Inc.	E-Municipality	20251127 to before 20260204	20260204	Patch available	CNA

E-Municipality VendorUniversal Software Inc. Affected 20251127 to before 20260204 Fixed in 20260204 Patch available CNA

Remediation

Fix · CNA E-Municipality (Universal Software Inc.) Fixed in 20260204

Timeline

2026-10-02 Threatist record created from CVE-2026-1621
2026-10-03 Alias added: GHSA-pv35-6x7m-m92j

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0846

TI-2024-00791 SQLi in Universal Software's FlexWater Corporate Water Management CVSS 3.1CRITICAL 9.8
TI-2026-06308 Improper Authentication in Universal Sotware's UKBS CVSS 3.1HIGH 8.8
TI-2026-01304 Admin Account Takeover in Universal Sotware's FlexCity/Kiosk CVSS 3.1HIGH 8.8
TI-2025-13110 Business Logic Error in Universal Software's FlexCity/Kiosk CVSS 3.1HIGH 8.8
TI-2026-01305 IDOR in Universal Sotware's FlexCity/Kiosk CVSS 3.1HIGH 8.3
TI-2026-05956 Improper Authorization in Universal Sotware's FlexCity CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences