CVE-2026-10711

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects CafePlus: from 12.05.03 before 12.05.04.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
AKIN Software Computer Import Export Industry and Trade Ltd.	CafePlus	>= 12.05.03, < 12.05.04

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0428

Timeline

Published: Jun 23, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-107126.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 CVE-2026-1071205.3The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verificat CVE-2026-1071216.5A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak CVE-2026-1071237.5A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs CVE-2026-1071246.4A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of CVE-2026-1071256.3A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the a CVE-2026-1071268.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it an CVE-2026-1071277.5The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauth CVE-2026-1071285.0The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted acc CVE-2026-1071295.5Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0 CVE-2026-1071306.9Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0 CVE-2026-107148.8A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta We