CVE-2026-12859CWE-862broken-access-control

CVE-2026-12859

Medium · published October 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-08T19:17Z
References (1)
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1276 · [email protected]
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 14:33Z
    IDOR in Caz Informatics' Advancity ALMS Cloud
    cvelistv5
  • 08 OCT 14:33Z
    IDOR in Caz Informatics' Advancity ALMS Cloud
    cvelistv5