Biletiva Ticketing Platform: Improper authorization via client-side enforcement
Summary
The Biletiva online ticketing platform from Divasoft Software and E-Commerce Inc. relies on client-side enforcement of security checks that should run on the server. A remote attacker without privileges and without user interaction could manipulate application state, with a possible impact on integrity and some impact on confidentiality and availability. The affected range is stated as up to and including 2026-07-23, and the CVE record does not specify the affected function.
Affected
- Biletiva Ticketing Platform, versions through 2026-07-23 (date-based range; no software version given)
- Default status in the CVE record: unaffected
Fixed in
Unknown.
Workaround
- Vendor-provided workarounds: Unknown.
- Ask the vendor in writing for a fix date and confirmation of patch status.
Exploitation
- Known exploited in the wild: no evidence found (not in KEV according to the sources).
- Public proof of concept: none found.
- Sources conflict on ease of exploitation; treat as unverified.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- If you use or depend on Biletiva for tickets or customer accounts, ask the operator for patch status and a fix date.
- Monitor accounts and orders for unexpected bookings or modified order states.
- Limit exposure of affected functions where possible.
- If you run your own ticketing or e-commerce software, verify that prices, roles and booking states are validated on the server side.
- Read the Turkish CERT advisory directly, as its content could not be verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record and VulDB analysis vuldb.com
- VulDB entry vuldb.com
- HOL CVE entry hol.org
- Strix CVE entry www.strix.ai
- The Hacker Wire www.thehackerwire.com
- Turkish CERT advisory (TR-CERT) siberguvenlik.gov.tr
- Vendor website www.biletiva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:35.
Original description (NVD)
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.