CVE-2026-107102

{
  "etk_id": "ETK-2026-860",
  "cve_id": "CVE-2026-107102",
  "display_id": "CVE-2026-107102",
  "ghsa_id": "GHSA-c484-2gh9-jpr5",
  "euvd_id": "EUVD-2026-94217",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Payment callback authentication bypass in Multi-tenant ERP System",
  "summary": "Multi-tenant ERP System payment callback handling may create authenticated sessions without adequately verifying payment status or the caller. An unauthenticated attacker could access another user's account when the payment callback API is reachable and its inputs can be manipulated.",
  "mitigation": "Restrict payment callback endpoints to trusted payment-provider sources and require server-side verification of payment status before creating a session. Review and invalidate suspicious sessions, and apply a vendor update when one is published.",
  "vendor": "Manacle Technologies",
  "product": "Multi-tenant ERP System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "version"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Multi-tenant ERP System",
      "purl": null
    }
  ],
  "cwes": [
    345
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.161,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.979884766666666,
  "t0_at": "2026-10-07T08:16:11.764000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T08:16:11.764000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T08:16:11.764000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107102"
    }
  }
}