---
id: "CVE-2026-14177"
kind: "vulnerability"
aliases: ["CVE-2026-14177"]
title: "IKAS E-Commerce Infrastructure: login responses reveal which accounts exist"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ikas E-Commerce Infrastructure", "fixed": ["after 2026-07-13"], "affected": "<= 2026-07-13 (date-based)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["account-enumeration", "e-commerce", "ikas", "other", "password-reset", "saas"]
not_affected_if: ["patched-after-2026-07-13"]
published_at: "2026-10-16T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:47:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14177", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:47:53+00:00"}]
---

# IKAS E-Commerce Infrastructure: login responses reveal which accounts exist

ikas E-Commerce Infrastructure's password-reset response differs for registered and unregistered accounts (CWE-204), so anyone can confirm which emails have accounts. No auth needed; no known exploitation or PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ikas E-Commerce Infrastructure affected <= 2026-07-13 (date-based) fixed after 2026-07-13

## How to check

Hosted ikas platform: nothing to inspect locally. Test your storefront's password-reset form with a known and an unknown email and compare the message, status and timing. Ask ikas to confirm your tenant runs a build dated after 2026-07-13.

## Fix

Run ikas build dated 2026-07-13 or later (TR-CERT advice). Exact fixed build not published; confirm with ikas.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14177
- 2026-10-25T03:47:53+00:00 analyst — TR-CERT (USOM TR-26-1348) CNA record: CWE-204 account enumeration via password-reset response in ikas, affected through 2026-07-13, fix = build dated 2026-07-13 or later (date-versioned SaaS; no semver). Vendor advisory not found; USOM page unreadable by tools, text via mirror. No exploitation/PoC found. Nothing verified.

## Documents

- [advisory] TR-26-1348 USOM/TR-CERT ikas advisory (via SiberAnaliz mirror text) https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1348
- [describes] CVE-2026-14177 CNA record (TR-CERT): user enumeration via password reset https://vulners.com/cvelist/CVELIST:CVE-2026-14177

## From the sources

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.

This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_