AKIN Software OctoCloud: Authorization bypass via user-controlled key
Summary
OctoCloud versions from 1.12.06 before 1.12.07 contain an authorization bypass (CWE-639, insecure direct object reference). An authenticated user with a low-privilege account can access functions and data that access control lists should restrict, which may allow high impact on confidentiality, integrity and availability. The CVSS base score is 8.8 per the CNA/NVD data, while VulDB rates it 6.3 Medium; the attack requires a valid login but no user interaction.
Affected
- AKIN Software OctoCloud from 1.12.06 before 1.12.07
- Some sources list only 1.12.06 as vulnerable; the vendor range should be verified.
Fixed in
- Upgrade to OctoCloud 1.12.07 or later.
- The exact build or package for the fix and availability for every supported branch are unknown.
Workaround
- No vendor workaround published.
- If patching is delayed, restrict access to the application and review which accounts can log in (general practice, not vendor guidance).
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- VulDB lists no exploit available and describes exploitation as easy.
- No public proof of concept found; this does not rule one out.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all OctoCloud installations and their versions.
- Upgrade any installation below 1.12.07 after testing.
- Prioritise installations reachable from the internet or with many user accounts.
- Review user accounts and monitor for unusual access to restricted functions.
- Verify the advisory TR-26-1272 and the vendor's patch notes, as the vendor advisory could not be confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TR-CERT advisory TR-26-1272 siberguvenlik.gov.tr
- VulDB 415326 vuldb.com
- Rapid7 record via Vulners vulners.com
- Strix CVE-2026-19083 www.strix.ai
- HOL Guard CVE-2026-19083 hol.org
- THREATINT CVE-2026-19083 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:13.
Original description (NVD)
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.