A vulnerability in the UlakPDF application allows an attacker to bypass the correct authorization checks and gain administrative privileges. The flaw is an incorrect authorization condition that can be exploited to execute privileged actions normally reserved for administrators. This surface can lead to wide-ranging damage including data disclosure, modification, or service disruption.

The affected product is TÜBİTAK ULAKBİM's UlakPDF, with all versions up to 09092026 impacted. No other vendors or products are listed as affected.

The database assigns a CVSS score of 6.8, indicating a moderate severity risk. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the naming convention of the vulnerability—"Header Fallback"—the attack vector most likely involves sending a specially crafted HTTP request that relies on a fallback header mechanism to spoof legitimate authentication. The attacker needs network access to the web service and would be able to elevate privileges if the vulnerability remains unpatched.