CVE-2024-11216
Broken Access Control in PozitifIK's Pik Online
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.
This issue affects Pik Online: before 3.1.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Broken Access Control in PozitifIK's Pik Online
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.
This issue affects Pik Online: before 3.1.5.
- Record
CVE-2024-11216- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-639, CWE-359
- Updated
- 2026-11-02
EUVDEUVD-2024-54008
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.
This issue affects Pik Online: before 3.1.5.
- Record
EUVD-2024-54008- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vvw9-5fr8-629r
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an...
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.This issue affects Pik Online: through 05.03.2025.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-vvw9-5fr8-629r- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-359
- Updated
- 2026-11-02
NVD
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.
This issue affects Pik Online: before 3.1.5.
- Record
CVE-2024-11216- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-359, CWE-639
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11216 is a high vulnerability (CVSS 7.6) in Pik Online Yazılım Çözümleri A.ş. Online, published March 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.