CVE Intelligence
Analysis AI-assisted

CVE-2026-2347: IDOR in Akilli Commerce E-Commerce Website

CVE-2026-2347 is an authorization bypass through a user-controlled key (IDOR) in the E-Commerce Website of Akilli Commerce Software Technologies Ltd. Co., affecting versions before 4.5.001. According to the record, the flaw allows session hijacking and has a CVSS 3.1 score of 9.8 (critical), but no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2347 describes an authorization bypass through a user-controlled key, a pattern commonly classified as an insecure direct object reference (IDOR), in the E-Commerce Website product from Akilli Commerce Software Technologies Ltd. Co. The record associates the issue with CWE-639 and states that it allows session hijacking. The record was published on 2026-05-14 and its source status is listed as Deferred.

Impact

  • The record states that the vulnerability allows session hijacking.
  • The CVSS 3.1 base score is 9.8 (critical), and both listed providers report the same score.
  • The SSVC assessment in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • Product: Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website.
  • Affected range in the record: versions before 4.5.001.
  • The record does not list any fixed version. The affected boundary of 4.5.001 is the only version reference provided.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation can be stated from this data. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none. The EPSS probability is 0.00426 with a percentile of 0.35114.

Remediation and mitigation

  • Identify all deployments of the E-Commerce Website product and compare their versions with the affected boundary of 4.5.001.
  • Contact the vendor or check the official advisory from the Turkish national CERT to confirm the corrective release and its availability.
  • Until a fix is applied, restrict access to the application as far as operations allow, and review how object identifiers are validated on the server side for each request.
  • Invalidate existing user sessions after applying changes, as a precaution against session misuse.

Detection guidance

  • Review web and application logs for requests that access records belonging to other accounts, especially sequences of changing identifiers.
  • Monitor for unusual session reuse, such as the same session token appearing from multiple locations or devices.
  • Correlate authentication events with object access patterns to highlight anomalies.

Limitations of the available information

The record does not describe the specific endpoints, parameters or conditions involved, and it does not list a fixed version. The CVSS score is provided by two sources with identical values. The EPSS date in the record is later than the publication date and should be verified against the source before being relied on. No vendor advisory was included in the record beyond the government reference.

Frequently asked questions

What is CVE-2026-2347?

It is an authorization bypass through a user-controlled key (IDOR) in the Akilli Commerce E-Commerce Website, affecting versions before 4.5.001. The record states it allows session hijacking.

How severe is this vulnerability?

The record lists a CVSS 3.1 base score of 9.8, which is rated critical. The SSVC assessment shows total technical impact and automatable as yes.

Is this vulnerability known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.