{"id":"CVE-2026-14177","kind":"vulnerability","aliases":["CVE-2026-14177"],"related":[],"title":"IKAS E-Commerce Infrastructure: login responses reveal which accounts exist","description":"Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.\n\nThis issue affects ikas E-Commerce Infrastructure: through 2026-07-13.","summary":"ikas E-Commerce Infrastructure's password-reset response differs for registered and unregistered accounts (CWE-204), so anyone can confirm which emails have accounts. No auth needed; no known exploitation or PoC.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ikas E-Commerce Infrastructure","fixed":["after 2026-07-13"],"affected":"<= 2026-07-13 (date-based)","ecosystem":"vendor"}],"ecosystems":[],"tags":["account-enumeration","e-commerce","ikas","other","password-reset","saas"],"not_affected_if":["patched-after-2026-07-13"],"how_to_check":"Hosted ikas platform: nothing to inspect locally. Test your storefront's password-reset form with a known and an unknown email and compare the message, status and timing. Ask ikas to confirm your tenant runs a build dated after 2026-07-13.","fix":"Run ikas build dated 2026-07-13 or later (TR-CERT advice). Exact fixed build not published; confirm with ikas.","status":"open","published_at":"2026-10-16T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:09+00:00","updated_at":"2026-10-25T03:47:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:25:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IKAS E-Commerce Infrastructure: login responses reveal which accounts exist","impact":"low","summary":"IKAS E-Commerce Infrastructure responds differently depending on whether an account exists, an observable response discrepancy. An attacker can use this account footprinting to confirm which customer or user accounts are registered.","category":"other","nicknames":[],"who_cares":["ikas","e-commerce"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker confirms which accounts exist, enabling targeted attacks","analyst_note":"Check the NVD entry and the vendor's advisory for affected versions, the exact endpoint, and whether a fixed release exists.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000498,"input_tokens":3287,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for affected versions, the exact endpoint, and whether a fixed release exists.","search":"'-07':95C '-13':96C '-14177':14A,17A '-2026':13A,16A '-204':52B '2026':94C 'account':10A,24B,50B,60B,83C 'account-enumer':23B 'affect':87C 'allow':82C 'anyon':54B 'auth':62B 'commerc':4A,28B,38B,80C,91C 'commerce':21A 'confirm':56B 'cve':12A,15A 'cwe':51B 'differ':45B 'discrep':71C 'e':3A,20A,27B,37B,79C,90C 'e-commerc':2A,26B,36B,78C,89C 'e-commerce':19A 'email':58B 'enumer':25B 'exist':11A 'exploit':66B 'footprint':84C 'ika':1A,29B,35B,74C,77C,88C 'ikas':18A 'inc':76C 'infrastructur':5A,39B,81C,92C 'infrastructure':22A 'issu':86C 'known':65B 'login':6A 'need':63B 'observ':69C 'password':32B,42B 'password-reset':31B,41B 'poc':68B 'regist':47B 'reset':33B,43B 'respons':7A,44B,70C 'reveal':8A 'saa':34B 'technolog':75C 'unregist':49B 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14177","severity":null,"published_at":"2026-10-16T09:17:04+00:00","modified_at":"2026-10-16T15:21:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-14177:795","url":null,"severity":null,"published_at":"2026-10-25T03:47:53+00:00","modified_at":"2026-10-25T03:47:53+00:00","first_seen_at":"2026-10-25T03:47:53+00:00","fetched_at":"2026-10-25T03:47:53+00:00","note":"TR-CERT (USOM TR-26-1348) CNA record: CWE-204 account enumeration via password-reset response in ikas, affected through 2026-07-13, fix = build dated 2026-07-13 or later (date-versioned SaaS; no semver). Vendor advisory not found; USOM page unreadable by tools, text via mirror. No exploitation/PoC found. Nothing verified."}],"documents":[{"id":3347,"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1348","title":"TR-26-1348 USOM/TR-CERT ikas advisory (via SiberAnaliz mirror text)","kind":"advisory","source":"analyst","text":"USOM TR-26-1348, 16.10.2026: vulnerability in ikas E-Ticaret Altyapisi (IKAS Teknoloji A.S.), CVE-2026-14177. Solution: upgrade to the 13.07.2026 version or later.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3349,"url":"https://vulners.com/cvelist/CVELIST:CVE-2026-14177","title":"CVE-2026-14177 CNA record (TR-CERT): user enumeration via password reset","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}