Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation…

The disclosure describes an *authorization bypass through a user-controlled SQL primary key* in Akmer Bilişim's parking and access-control software stack, which likely means a web endpoint accepts an attacker-supplied record ID and then reads or updates rows it should have authorization-checked first. That can translate into arbitrary access to ticket, vehicle, customer, balance, or access-event records without needing a classic quote-based SQL injection payload. Publicly indexed sources available at assessment time do not clearly publish an exact affected version range or fixed build, so treat Akmer/TeknoPass web components present in your environment as potentially in scope until the vendor publishes build-level guidance.

The vendor's 9.8 Critical score assumes a wide-open, internet-exposed, unauthenticated path to full compromise across confidentiality, integrity, and availability. Reality is narrower: the title points more toward an *IDOR/row-level authorization failure with SQL-backed access* than turnkey host takeover, the product is a niche line-of-business platform rather than ubiquitous edge software, and there is no KEV listing or public exploitation evidence in accessible indexed sources. That keeps this firmly important, but it does not read like a universal emergency patch event for every enterprise on Monday morning.

Why this verdict

• Down from 9.8 because deployment reality matters: Akmer/TeknoPass is a niche parking/access-control application, not a universally exposed edge stack, so the reachable population is materially smaller than the vendor CVSS assumes.
• Down again because the title suggests row-level auth failure, not guaranteed host takeover: CWE-566 usually means unauthorized object access or modification through attacker-chosen keys, which is serious but often narrower than full arbitrary SQL execution or RCE.
• No active-exploitation amplifier: no KEV listing, no public campaign evidence, and no public PoC found in accessible indexed sources, so there is no reason to keep it in the emergency drop everything bucket.

Why not higher?

I am not keeping this at CRITICAL because the available facts do not show widespread internet exposure, public exploitation, or a reliable path from the application flaw to immediate host-level compromise. The vendor's 9.8 is technically plausible only in the most exposed configuration and ignores how rarely this kind of product is deployed as a broad anonymous internet surface.

Why not lower?

I am not pushing it to MEDIUM because the reported path is still remote, no-auth, low-complexity at the web layer and the affected product appears tied to physical access and payment operations. If your portal is reachable, unauthorized reads and writes against operational records can absolutely create real business impact.

1. Put the portal behind an access broker — Require VPN, ZTNA, or an identity-aware proxy for any Akmer/TeknoPass web interface not strictly needed on the public internet. For a HIGH verdict, deploy this within 30 days if patching cannot be completed first, because the biggest risk reducer here is shrinking anonymous reachability.
2. Constrain source IPs — Restrict management, kiosk-admin, and API access to known site networks, vendor support ranges, and administrator jump hosts. Apply within 30 days; this directly attacks the unauthenticated remote prerequisite.
3. Turn on database and application auditing — Log object-ID access, update operations, bulk sequential record requests, and admin/API mutations on parking sessions, plate mappings, balances, and access-control tables. Enable within 30 days so you can detect row-walking and unauthorized record changes that perimeter controls may miss.
4. Review app roles and tenant scoping — Even if the bug is pre-auth in some paths, many real deployments expose adjacent authenticated workflows with excessive read/write scope. Tighten site, tenant, and operator permissions within 30 days to reduce blast radius if exploitation lands inside partially trusted workflows.
5. Monitor for IDOR-style probing — Create detections for rapid increments across numeric IDs, repeated 200 responses on neighboring object identifiers, unusual access to historical sessions, and mismatches between gate events and billing records. Stand this up within 30 days because this weakness often looks like valid business traffic unless you watch for enumeration patterns.

Run this from an auditor workstation that can reach the target web application, not from the database server. Invoke it as python3 check_cve_2026_4104.py https://parking.example.com or python3 check_cve_2026_4104.py https://parking.example.com --fixed-version 2026.06.15; no admin privileges are required, only outbound HTTPS access to the target.

#!/usr/bin/env python3
# check_cve_2026_4104.py
# Purpose: lightweight external fingerprint for Akmer/TeknoPass exposure and visible versioning.
# This does NOT exploit the target. It reports VULNERABLE / PATCHED / UNKNOWN based on visible product markers
# and optionally a defender-supplied fixed version string.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/network error

import argparse
import re
import sys
from urllib.parse import urljoin

try:
    import requests
except Exception:
    print('UNKNOWN - missing dependency: requests')
    sys.exit(2)

PRODUCT_MARKERS = [
    r'Akmer',
    r'Akmer\s*Bili',
    r'TeknoPass',
    r'otopark',
    r'access\s*control',
    r'parking\s*automation',
]

VERSION_PATTERNS = [
    r'version\s*[:=]\s*([0-9][0-9A-Za-z._\-]+)',
    r'build\s*[:=]\s*([0-9][0-9A-Za-z._\-]+)',
    r'v([0-9]+(?:\.[0-9A-Za-z_\-]+)+)',
]

COMMON_PATHS = [
    '/',
    '/login',
    '/admin',
    '/api',
    '/swagger',
    '/docs',
]


def normalize(v):
    return re.sub(r'[^0-9A-Za-z]+', '.', v).strip('.').lower()


def looks_like_product(text):
    for pat in PRODUCT_MARKERS:
        if re.search(pat, text, re.IGNORECASE):
            return True
    return False


def extract_version(text):
    for pat in VERSION_PATTERNS:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def fetch(session, base, path):
    url = urljoin(base.rstrip('/') + '/', path.lstrip('/'))
    try:
        r = session.get(url, timeout=10, allow_redirects=True, verify=True)
        return url, r.status_code, r.text[:500000]
    except requests.RequestException:
        return url, None, ''


def main():
    ap = argparse.ArgumentParser(description='Non-intrusive Akmer/TeknoPass exposure/version check for CVE-2026-4104')
    ap.add_argument('base_url', help='Base URL, e.g. https://parking.example.com')
    ap.add_argument('--fixed-version', help='Known fixed version/build from vendor advisory, if available')
    args = ap.parse_args()

    session = requests.Session()
    session.headers.update({'User-Agent': 'noisgate-cve-2026-4104-check/1.0'})

    product_seen = False
    discovered_version = None
    reachable = False
    seen_urls = []

    for path in COMMON_PATHS:
        url, status, text = fetch(session, args.base_url, path)
        seen_urls.append((url, status))
        if status is not None:
            reachable = True
        if not text:
            continue
        if looks_like_product(text):
            product_seen = True
        if discovered_version is None:
            discovered_version = extract_version(text)

    if not reachable:
        print('UNKNOWN - target not reachable from this workstation')
        sys.exit(3)

    if not product_seen:
        print('UNKNOWN - no visible Akmer/TeknoPass markers detected on common paths')
        sys.exit(2)

    if args.fixed_version and discovered_version:
        if normalize(discovered_version) == normalize(args.fixed_version):
            print(f'PATCHED - product marker found and visible version/build matches supplied fixed version: {discovered_version}')
            sys.exit(0)
        else:
            print(f'VULNERABLE - product marker found and visible version/build ({discovered_version}) does not match supplied fixed version ({args.fixed_version})')
            sys.exit(1)

    if discovered_version and not args.fixed_version:
        print(f'UNKNOWN - Akmer/TeknoPass marker found; visible version/build discovered: {discovered_version}; compare manually to vendor fixed build once published')
        sys.exit(2)

    print('UNKNOWN - Akmer/TeknoPass marker found but no trustworthy version/build string exposed; use authenticated inventory or vendor advisory to confirm patch state')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Akmer Bilişim company site
2. Akmer Bilişim English product/company overview
3. TeknoPass product site
4. TeknoPass English overview
5. MITRE CWE-566
6. MITRE CWE-89
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST CVSS v3.1 Specification