AKIN OctoCloud authorization bypass exposes restricted functions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
AKIN Software's OctoCloud from 1.12.06 before 1.12.07 has an authorization bypass through a user-controlled key (CWE-639). Because the product does not properly restrict functionality by access control lists, a low-privileged user with network access can reach functions they should not be able to use, affecting confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AKIN Software Computer Import Export Industry and Trade Ltd. | OctoCloud | 1.12.06 to before 1.12.07 | 1.12.07 | Patch available | CNA |
- OctoCloud VendorAKIN Software Computer Import Export Industry and Trade Ltd. Affected 1.12.06 to before 1.12.07 Fixed in 1.12.07 Patch available CNA
Remediation
Update OctoCloud to version 1.12.07, which is the fixed version listed for this product.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA OctoCloud (AKIN Software Computer Import-Export Industry and Trade Co. Ltd.) Fixed in 1.12.07
Timeline
- 2026-10-08 Threatist record created from CVE-2026-19083
- 2026-10-10 Priority changed: LOW → MEDIUM
References
More AKIN Software Computer Import Export Industry and Trade Ltd. vulnerabilities
- TI-2026-69468 Database credentials exposed in AKINSOFT WOLVOX Control Panel CVSS 3.1CRITICAL 9.8
- TI-2026-69423 Password reset codes in AKIN MyRezzta can be brute forced CVSS 3.1CRITICAL 9.1
- TI-2026-09209 RCE in Akınsoft's CafePlus CVSS 3.1HIGH 8.8
- TI-2026-13115 Path Traversal in AKIN Software's Wolvox9 ERP CVSS 3.1HIGH 7.5
- TI-2025-09087 IDOR in Akınsoft QRMenu CVSS 3.1HIGH 7.5
- TI-2026-09321 Reflected XSS in Akinsoft's e-Commerce CVSS 3.1MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences