{"id":"CVE-2026-111552","kind":"vulnerability","aliases":["CVE-2026-111552"],"related":[],"title":"Hyper E-Commerce storefront and admin panel allow authentication bypass","description":"Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.","summary":"Hyper E-Commerce Infrastructure, its dealer integration, and its storefront and management panel rely on single-factor authentication that can be bypassed. An attacker can get past the login and act as an authenticated user.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","hyper-e-commerce","self-hosted","vendor"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed version of Hyper E-Commerce Infrastructure, the dealer integration, and the storefront and management panel against the fixed versions below","fix":"- Hyper E-Commerce Infrastructure: `1.1` or later\n- Hyper E-Commerce Infrastructure dealer integration: `1.2` or later\n- Hyper E-Commerce Infrastructure storefront application and management panel: `2.1796` or later","status":"open","published_at":"2026-11-12T13:17:09+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:51+00:00","updated_at":"2026-11-12T13:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T13:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- Hyper E-Commerce Infrastructure: `1.1` or later\n- Hyper E-Commerce Infrastructure dealer integration: `1.2` or later\n- Hyper E-Commerce Infrastructure storefront application and management panel: `2.1796` or later","reach":"internet","title":"Hyper E-Commerce storefront and admin panel allow authentication bypass","impact":"high","summary":"Hyper E-Commerce Infrastructure, its dealer integration, and its storefront and management panel rely on single-factor authentication that can be bypassed. An attacker can get past the login and act as an authenticated user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hyper-e-commerce","e-commerce","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker bypasses login and gains administrative control of the store","analyst_note":"Confirm the exact bypass path and whether the storefront and management panel is internet-facing in typical deployments, using the NVD entry.","how_to_check":"- Check the installed version of Hyper E-Commerce Infrastructure, the dealer integration, and the storefront and management panel against the fixed versions below\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any online store or dealer setup running the Hyper E-Commerce Infrastructure, its dealer integration, or its storefront and management panel below the fixed versions is exposed. The sources do not describe the exact login path or configuration needed, so teams should confirm whether their deployment uses these components.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000779,"input_tokens":4688,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111552':14A,17A '-2026':13A,16A '1.1':121C '1.2':130C '2.1796':142C 'act':61B 'admin':7A 'affect':114C 'allow':9A,109C 'applic':105C,137C 'attack':54B 'authent':10A,48B,64B,71C,110C 'bypass':11A,52B,111C 'commerc':4A,20B,24B,32B,81C,90C,102C,118C,125C,134C 'cve':12A,15A 'dealer':35B,92C,127C 'e':3A,19B,23B,31B,80C,89C,101C,117C,124C,133C 'e-commerc':2A,18B,30B,79C,88C,100C,116C,123C,132C 'factor':47B,70C 'get':56B 'host':27B 'hyper':1A,22B,29B,74C,78C,83C,87C,95C,99C,115C,122C,131C 'hyper-e-commerc':21B 'infrastructur':33B,82C,91C,103C,119C,126C,135C 'integr':36B,93C,128C 'issu':113C 'login':59B 'ltd':76C,85C,97C 'manag':41B,107C,139C 'panel':8A,42B,108C,140C 'past':57B 'reli':43B 'self':26B 'self-host':25B 'singl':46B,69C 'single-factor':45B,68C 'storefront':5A,39B,104C,136C 'teknoloji':75C,84C,96C 'use':66C 'user':65B 'vendor':28B 'vulner':72C 'şti':77C,86C,98C","nicknames":[],"mitigations":[],"who_affected":"Any online store or dealer setup running the Hyper E-Commerce Infrastructure, its dealer integration, or its storefront and management panel below the fixed versions is exposed. The sources do not describe the exact login path or configuration needed, so teams should confirm whether their deployment uses these components.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","high","hyperecommerce","selfhosted","vendor"],"campaign_type":null,"search_a":"'-111552':14A,17A '-2026':13A,16A 'admin':7A 'allow':9A 'authent':10A 'bypass':11A 'commerc':4A 'cve':12A,15A 'e':3A 'e-commerc':2A 'hyper':1A 'panel':8A 'storefront':5A","search_b":"'act':61B 'attack':54B 'authent':48B,64B 'bypass':52B 'commerc':20B,24B,32B 'dealer':35B 'e':19B,23B,31B 'e-commerc':18B,30B 'factor':47B 'get':56B 'host':27B 'hyper':22B,29B 'hyper-e-commerc':21B 'infrastructur':33B 'integr':36B 'login':59B 'manag':41B 'panel':42B 'past':57B 'reli':43B 'self':26B 'self-host':25B 'singl':46B 'single-factor':45B 'storefront':39B 'user':65B 'vendor':28B","search_c":"'1.1':121C '1.2':130C '2.1796':142C 'affect':114C 'allow':109C 'applic':105C,137C 'authent':71C,110C 'bypass':111C 'commerc':81C,90C,102C,118C,125C,134C 'dealer':92C,127C 'e':80C,89C,101C,117C,124C,133C 'e-commerc':79C,88C,100C,116C,123C,132C 'factor':70C 'hyper':74C,78C,83C,87C,95C,99C,115C,122C,131C 'infrastructur':82C,91C,103C,119C,126C,135C 'integr':93C,128C 'issu':113C 'ltd':76C,85C,97C 'manag':107C,139C 'panel':108C,140C 'singl':69C 'single-factor':68C 'storefront':104C,136C 'teknoloji':75C,84C,96C 'use':66C 'vulner':72C 'şti':77C,86C,98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111552","severity":null,"published_at":"2026-11-12T13:17:09+00:00","modified_at":"2026-11-12T13:17:09+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}