Description
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass.

This issue affects UlakPDF: through 09092026.
Published: 2026-09-24
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an incorrect authorization flaw in TÜBİTAK ULAKBİM's UlakPDF that allows an attacker to bypass authentication by forging the ePPN SAML attribute. The flaw permits unauthorized access to protected documents or administrative functions once authentication is bypassed. This is a high‑severity issue identified as CWE‑863.

Affected Systems

The affected system is TÜBİTAK ULAKBİM’s UlakPDF document service. All releases up to and including version 09092026 are vulnerable. No newer releases are known to contain the patch based on the provided data.

Risk and Exploitability

The CVSS score of 7.4 indicates a high impact, and because no EPSS data is provided, the exploitation probability is unknown. The vulnerability appears to be remotely exploitable through a SAML response that can be crafted by an attacker. The flaw is not listed in CISA's KEV catalog, but the potential for unauthorized data access makes it highly relevant to organizations relying on UlakPDF.

Generated by OpenCVE AI on September 25, 2026 at 01:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update UlakPDF to a version newer than 09092026.
  • Reconfigure the SAML service to enforce validation of the ePPN attribute before granting access.
  • Verify that all protected resources require authenticated sessions and do not rely solely on SAML attribute checks.

Generated by OpenCVE AI on September 25, 2026 at 01:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Tübi̇tak Ulakbi̇m
Tübi̇tak Ulakbi̇m ulakpdf
Vendors & Products Tübi̇tak Ulakbi̇m
Tübi̇tak Ulakbi̇m ulakpdf

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.
Title SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Tübi̇tak Ulakbi̇m Ulakpdf
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-24T14:41:39.471Z

Reserved: 2026-09-10T12:21:09.545Z

Link: CVE-2026-88907

cve-icon Vulnrichment

Updated: 2026-09-24T14:41:35.928Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T13:17:15.873

Modified: 2026-09-24T19:36:51.280

Link: CVE-2026-88907

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T14:17:47Z

Weaknesses