{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-86450",
        "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "state": "PUBLISHED",
        "assignerShortName": "TR-CERT",
        "dateReserved": "2026-09-07T12:54:00.924Z",
        "datePublished": "2026-09-29T13:46:39.350Z",
        "dateUpdated": "2026-09-30T15:28:20.067Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
                "shortName": "TR-CERT",
                "dateUpdated": "2026-09-29T13:46:39.350Z"
            },
            "title": "Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal",
            "datePublic": "2026-09-29T13:43:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-201",
                            "description": "CWE-201 Insertion of sensitive information into sent data",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-1",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Parla Auto Automotive Trading Limited Company",
                    "product": "DetaWix Mobile Web Portal",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "v1.0.19",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects DetaWix Mobile Web Portal: before v1.0.19.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects DetaWix Mobile Web Portal: before v1.0.19.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1210",
                    "tags": [
                        "government-resource"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "NONE",
                        "availabilityImpact": "NONE",
                        "baseSeverity": "HIGH",
                        "baseScore": 7.5,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                    }
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Anonim",
                    "type": "finder"
                }
            ],
            "source": {
                "defect": [
                    "TR-26-1210"
                ],
                "advisory": "TR-26-1210",
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.5"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2026-86450",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2026-09-30T15:18:07.892513Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-09-30T15:28:20.067Z"
                }
            }
        ]
    }
}