TI-2026-83798 Aliases CVE-2026-92886 GHSA-wc8q-j59v-43c2

Privilege escalation in TÜBİTAK BİLGEM eta-register

LOW 35CWE-862Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

TÜBİTAK BİLGEM eta-register from 2.0.8 before 2.0.9 has a missing authorization check (CWE-862) that lets a local user with low privileges gain higher privileges. A successful attack can fully compromise confidentiality, integrity and availability of the affected system.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00133 2nd percentileScored 2026-11-07

Fix Fixed eta-register (TÜBİTAK BİLGEM Software Technologies Research Institute): 2.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TÜBİTAK BİLGEM Software Technologies Research Institute	eta-register	2.0.8 to before 2.0.9	2.0.9	Patch available	CNA

eta-register VendorTÜBİTAK BİLGEM Software Technologies Research Institute Affected 2.0.8 to before 2.0.9 Fixed in 2.0.9 Patch available CNA

Remediation

Update eta-register to version 2.0.9, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA eta-register (TÜBİTAK BİLGEM Software Technologies Research Institute) Fixed in 2.0.9

Timeline

2026-11-02 Threatist record created from CVE-2026-92886
2026-11-02 Alias added: GHSA-wc8q-j59v-43c2
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: MEDIUM → LOW

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1440

TI-2026-53129 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1CRITICAL 9.1
TI-2026-15720 Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1HIGH 7.5
TI-2026-15985 OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair CVSS 3.1HIGH 7.8
TI-2026-55130 Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter CVSS 3.1HIGH 7.1
TI-2026-15399 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer CVSS 3.1HIGH 7.1
TI-2026-85904 Path traversal in TÜBİTAK BİLGEM pardus-boot-repair CVSS 3.1MEDIUM 6.6

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences