CVE-2026-10711

RCE in Akınsoft's CafePlus

Published Jun 23, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects CafePlus: from 12.05.03 before 12.05.04.

Analysis

Technical impact

The vulnerability arises from missing authentication mechanisms for a critical function in CafePlus, allowing attackers to access functionality that should be secured by access control lists. Without proper authentication, malicious users can invoke privileged operations, potentially leading to remote code execution. This weakness is classified as CWE-306, missing authentication.

Affected Systems

AKIN Software Computer Import Export Industry and Trade Ltd. produces CafePlus. Versions ranging from 12.05.03 up to, but not including, 12.05.04 are impacted. Users running these versions are susceptible unless they restrict exposure or apply a patch.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and while an EPSS score is not available, the lack of a KEV listing suggests no confirmed exploits yet. Nevertheless, the missing authentication implies that once the web interface or API is reachable, an attacker can execute the vulnerable function without needing valid credentials. Attackers could automate requests to the exposed endpoint to gain arbitrary code execution on the host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AKIN Software Computer Import Export Industry and Trade Ltd.

CafePlus

unaffected

Version	Status	Constraints
`12.05.03`	affected	< 12.05.04

No data.

Vendor Product Versions

Akin

Cafeplus

Version	Status	Scheme	Platform
`[12.05.03,12.05.04)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest vendor patch or upgrade to CafePlus 12.05.04 or later where the authentication check has been restored.
If an upgrade is not immediately possible, restrict access to the CafePlus service so that only trusted internal hosts can reach it, effectively blocking unauthenticated external access.
Disable or isolate the vulnerable functionality until a patch is applied, or reconfigure the application to require authentication for all protected operations.

Generated by OpenCVE AI on June 23, 2026 at 13:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.366% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0428

History

Jun 23, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Akin Akin cafeplus
Vendors & Products		Akin Akin cafeplus

Jun 23, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.
Title		RCE in Akınsoft's CafePlus
Weaknesses		CWE-306
References		https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0428
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`