{"id":"CVE-2026-16307","kind":"vulnerability","aliases":["CVE-2026-16307"],"related":[],"title":"EdoWEB: authorization bypass lets users reach restricted functionality","description":"Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects EdoWEB: before 780-g7.","summary":"EdoWEB from Netiket Information Technologies has an authorization bypass caused by a user-controlled key. An attacker can reach functionality that access control lists should restrict.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edoweb","netiket","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed EdoWEB version against `780-g7`\n- unknown","fix":"- Upgrade EdoWEB to `780-g7` or later\n- unknown","status":"open","published_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:16+00:00","updated_at":"2026-10-27T14:33:16+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:33:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade EdoWEB to `780-g7` or later\n- unknown","reach":"unknown","title":"EdoWEB: authorization bypass lets users reach restricted functionality","impact":"medium","summary":"EdoWEB from Netiket Information Technologies has an authorization bypass caused by a user-controlled key. An attacker can reach functionality that access control lists should restrict.","category":"other","nicknames":[],"who_cares":["edoweb","netiket","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to restricted functionality within EdoWEB","analyst_note":"Find the vendor advisory or a detailed write-up to confirm the affected endpoint, required privileges, and which fixed build applies, starting from https://nvd.nist.gov/vuln/detail/CVE-2026-16307.","how_to_check":"- Check the installed EdoWEB version against `780-g7`\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running EdoWEB versions before `780-g7`. The sources do not say which deployments or configurations are most exposed, and they do not describe the data path of the bypass.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000561,"input_tokens":3302,"output_tokens":461,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16307':11A,14A '-2026':10A,13A '780':74C 'access':43B,62C 'acl':68C 'affect':71C 'allow':61C 'attack':38B 'author':2A,28B,48C 'bypass':3A,29B,49C 'caus':30B 'constrain':66C 'control':35B,44B,53C 'cve':9A,12A 'edoweb':1A,15B,21B,60C,72C 'function':8A,41B,63C 'g7':75C 'host':20B 'inform':24B,58C 'issu':70C 'key':36B,54C 'let':4A 'list':45B 'netiket':16B,23B,57C 'proper':65C 'reach':6A,40B 'restrict':7A,47B 'self':19B 'self-host':18B 'technolog':25B,59C 'user':5A,34B,52C 'user-control':33B,51C 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Teams running EdoWEB versions before `780-g7`. The sources do not say which deployments or configurations are most exposed, and they do not describe the data path of the bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16307","severity":null,"published_at":"2026-10-27T14:17:00+00:00","modified_at":"2026-10-27T14:17:00+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}