The vulnerability is a client‑side enforcement of server‑side security flaw that allows attackers to manipulate state in the Biletiva Ticketing Platform. The flaw permits users to bypass intended authorization controls, potentially changing event tickets, prices, or user permissions without proper validation. This can lead to loss of data integrity, unauthorized access to privileged functions, or denial of service if critical tickets are corrupted.

Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform. All released versions through 2026‑07‑23 are affected, as the vulnerability exists in the software stack prior to that date and no subsequent release has been confirmed to fix the issue.

With a CVSS score of 8.6, the vulnerability is considered high risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, through crafted client requests or altered browser behavior that manipulates state submission to the server. Based on the description, exploitation would require an attacker to supply manipulated input that is accepted by the server as legitimate, thereby bypassing authorization checks.