TI-2026-81154 Aliases CVE-2026-16307 GHSA-2wm8-6hj5-fwmq

Authorization bypass in Netiket EdoWEB exposes restricted functions

LOW 19CWE-639Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Netiket Information Technologies EdoWEB before 780-g7 contains an authorization bypass through a user-controlled key (CWE-639). A remote attacker with low privileges can reach functionality that access control lists do not properly restrict, which exposes some confidential data.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix Fixed EdoWEB (Netiket Information Technologies): 780-g7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Netiket Information Technologies	EdoWEB	before 780-g7	780-g7	Patch available	CNA

EdoWEB VendorNetiket Information Technologies Affected before 780-g7 Fixed in 780-g7 Patch available CNA

Remediation

Update Netiket Information Technologies EdoWEB to 780-g7, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA EdoWEB (Netiket Information Technologies) Fixed in 780-g7

Timeline

2026-10-27 Threatist record created from CVE-2026-16307
2026-10-27 Alias added: GHSA-2wm8-6hj5-fwmq
2026-11-04 CISA SSVC decision points changed

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1409

TI-2025-11997 IDOR in Netiket''s ApplyLogic CVSS 3.1HIGH 7.6
TI-2026-13632 IDOR in Netiket Information Technologies' EdoWEB CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences