CVE-2026-13138— Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
Quick assessment
Affected
Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Disvasoft Software and E-Commerce Inc. 的 Biletiva 票务平台存在客户端强制执行服务端安全漏洞，导致状态可被操纵。 该问题影响 Biletiva 票务平台：截至 2026 年 7 月 23 日的所有版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13138
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
Source: CVE Program / CVE List V5
Vulnerability Description
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State.
This issue affects Biletiva Ticketing Platform: through 2026-07-23.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端安全的客户端实施
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Divasoft Software and E-Commerce Inc. | Biletiva Ticketing Platform | 0 ~ 2026-07-23 | - |
|
II. Public POCs for CVE-2026-13138
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13138
请登录查看更多情报信息。
Other References for CVE-2026-13138 (1)
-
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1309 government-resource
IV. Related Vulnerabilities
Same weakness: CWE-602
-
CVE-2026-89206
RUGGEDCOM CROSSBOW 低于V6.0存在服务器端授权绕过漏洞 -
CVE-2026-89205
RUGGEDCOM CROSSBOW V6.0前版本服务器端授权绕过漏洞 -
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Clie -
CVE-2026-89175
Kingdom Communication Associated｜Smart Video Intercom System -
CVE-2026-84841
tsi-coop tsi-dpdp-cms client-side enforcement of server-side
V. Comments for CVE-2026-13138
No comments yet