An insecure direct object reference flaw was discovered in teklifolustur_app, a PHP web platform for quote management. Authenticated users can modify the offer_id parameter when viewing offers, bypassing missing authorization checks and retrieving offers that belong to other users. This flaw can expose confidential client data, allow data tampering, and potentially breach privacy requirements, as demonstrated by the CWE-639 classification.

Vendor sibercii6-crypto provides the teklifolustur_app web application. The vulnerability affects the offer view functionality, present in all releases before the patch commit dd082a134a225b8dcd401b6224eead4fb183ea1c. No specific version range is listed, so all instances running the pre‑patch source code are potentially vulnerable.

The CVSS v3 score is 7.1, indicating high severity, while the EPSS score is below 1%, suggesting a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the system and can then manipulate HTTP request parameters to access other users’ offers. The lack of an official workaround implies a direct patch is required, and the low EPSS may reduce the immediacy of exploitation but does not mitigate the confidentiality risk.