CVE-2026-7189: Proliz OBS Auth Bypass Vulnerability

CVE-2026-7189 Overview

CVE-2026-7189 is an information exposure vulnerability affecting Proliz Software Ltd. Co.'s OBS (Student Information System) prior to version v3.6.0. The flaw stems from access control weaknesses that allow unauthenticated attackers to reach functionality not properly constrained by Access Control Lists (ACLs). As a result, sensitive information is inserted into data sent to unauthorized recipients over the network. The vulnerability maps to [CWE-201] (Insertion of Sensitive Information Into Sent Data) and can be triggered remotely without user interaction or privileges.

Critical Impact
Remote, unauthenticated attackers can obtain sensitive data from the OBS platform by exercising functionality that should require access controls.

Affected Products

Proliz OBS versions prior to v3.6.0
Proliz Software Ltd. Co. Student Information System deployments
Any web-exposed OBS instance not yet patched to v3.6.0 or later

Discovery Timeline

2026-07-17 - CVE-2026-7189 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-7189

Vulnerability Analysis

The vulnerability exists in Proliz OBS, a student information management platform. The application exposes functionality that is not properly protected by Access Control Lists. Attackers can reach these endpoints without authenticating and receive sensitive information in the server's response. The scope is limited to confidentiality: integrity and availability are not affected, but the exposed data may include personally identifiable information (PII), academic records, or other regulated data typical of a student information system. The Turkish national cyber security authority documented the issue in advisory TR-26-0571.

Root Cause

The root cause is missing or misconfigured authorization checks on server-side handlers. Functionality that should require a valid session and role-based permissions is instead reachable by anonymous callers. When these handlers execute, they return sensitive fields in their response payloads. This pattern is classified under [CWE-201], where sensitive information leaks through legitimate outbound data channels because access constraints are absent or bypassed.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests to unauthenticated OBS endpoints. The server responds with data intended for authorized users. Because the request pattern mirrors normal application traffic, exploitation can be difficult to distinguish from legitimate activity without granular endpoint-level auditing. No public proof-of-concept exploit is currently listed for CVE-2026-7189, and the EPSS forecast for near-term exploitation remains low.

No verified exploit code is publicly available. Refer to the Siber Güvenlik Notification TR-26-0571 for vendor-specific technical details.

Detection Methods for CVE-2026-7189

Indicators of Compromise

Unauthenticated HTTP requests to OBS application endpoints that return response bodies containing student, staff, or administrative records
Anomalous outbound response sizes from OBS servers to unauthenticated clients
Access log entries showing HTTP 200 responses to sensitive OBS routes without preceding authentication events

Detection Strategies

Inspect web server and application logs for requests to OBS endpoints that succeed without a valid session cookie or authorization header
Correlate NetFlow or reverse-proxy telemetry to identify single source IPs enumerating multiple OBS resource paths
Deploy Web Application Firewall (WAF) rules that flag responses returning structured PII fields to unauthenticated sessions

Monitoring Recommendations

Enable verbose access logging on the OBS reverse proxy and forward logs to a centralized SIEM for retention and correlation
Baseline normal request patterns per endpoint and alert on deviations, particularly high-volume reads from external IP ranges
Monitor for scraping behavior: sequential IDs, high request rates, and repeated calls to the same endpoint from a single client

How to Mitigate CVE-2026-7189

Immediate Actions Required

Upgrade Proliz OBS to version v3.6.0 or later without delay
Inventory all internet-exposed OBS instances and restrict inbound access to trusted networks until patched
Review web server access logs since deployment for signs of prior unauthenticated data access
Rotate any credentials, tokens, or session identifiers that may have been exposed through vulnerable endpoints

Patch Information

Proliz Software Ltd. Co. has addressed CVE-2026-7189 in OBS v3.6.0. Administrators should coordinate with the vendor to obtain the update and follow the upgrade procedure defined by Proliz. Additional information is available in the Siber Güvenlik advisory TR-26-0571.

Workarounds

Place the OBS application behind an authenticating reverse proxy or VPN until the patch is applied
Configure WAF rules to block anonymous requests to sensitive OBS routes and inspect response bodies for PII patterns
Restrict network exposure via firewall ACLs, permitting access only from institutional IP ranges
Enforce rate limiting on OBS endpoints to slow automated data harvesting attempts

bash

# Example: restrict OBS to institutional network via iptables until patched
iptables -A INPUT -p tcp --dport 443 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP