PT-2026-27923 · Unknown · Kargo Takip

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25365

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kargo Takip versions prior to 0.2.4

Description A missing authorization flaw exists in Özgür KARALAR Kargo Takip kargo-takip-turkiye. This issue stems from incorrectly configured access control security levels, potentially allowing unauthorized access. The API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations Update Kargo Takip to version 0.2.4 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25365

Affected Products

Kargo Takip

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25365 · Security Note
• https://twitter.com/CVEnew/status/2038516997458481282 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/kargo-takip-turkiye/vulnerability/wordpress-kargo-takip-plugin-0-2-4-broken-access-control-vulnerability?_s_id=cve · Note