CVE-2025-9062 - IDOR in MeCODE Informatics' Envanty

Back Back to CVE browser

HIGH

IDOR in MeCODE Informatics' Envanty

Published Feb 19, 2026

7.3

HIGH

CVSS 3.1

EPSS 0.22%

Description

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection.

This issue affects Envanty: before 1.0.6.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

Affected products

Vendor MeCODE Informatics and Engineering Services Ltd. Product Envanty Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <1.0.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MeCODE Informatics and Engineering Services Ltd.

Envanty

n/a

Version	Status	Constraints
0	affected	<1.0.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-207678
Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0076
government-resource
https://www.usom.gov.tr/bildirim/tr-26-0076
government-resourcebroken-link

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-207678		Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0076		government-resource
https://www.usom.gov.tr/bildirim/tr-26-0076		government-resourcebroken-link