CVE-2026-11838

Deferred Deferred - Pending Action

Authentication Bypass in Yordam Library Reservation System

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-11838

EUVD

EUVD-2026-74781

Affected Vendors & Products

Vendor	Product	Version / Range
yordam_informatics_technology_consulting_training_and_electronic_systems_industry_and_trade_inc	library_reservation_system	to 22.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication issue in the Yordam Informatics Library Reservation System before version 22.2. It allows attackers to manipulate input data without proper authentication, potentially leading to unauthorized actions or data changes.

Detection Guidance

This vulnerability involves missing authentication for critical functions in the Library Reservation System before v22.2. To detect it, inspect network traffic for unauthenticated requests to sensitive endpoints or functions. Check system logs for unusual input data manipulation attempts. Verify if the system allows actions without proper authentication by testing endpoints manually or with tools like Burp Suite or OWASP ZAP.

Impact Analysis

An attacker could exploit this to alter reservation data, such as booking or canceling reservations without permission. This may disrupt library services or lead to incorrect records. The impact is limited since authentication is required but the lack of it allows low-privilege manipulation.

Compliance Impact

This vulnerability allows input data manipulation due to missing authentication for critical functions, which could lead to unauthorized access or data tampering. Such issues may violate compliance requirements under GDPR (data integrity and access controls) and HIPAA (secure access to protected health information).

Mitigation Strategies

Update the Library Reservation System to version 22.2 or later to address the missing authentication issue. Ensure all critical functions require proper authentication before allowing input data manipulation.

Hi! I’m here to help you understand CVE-2026-11838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70