# CVE-2025-1031: Utarit SoliClub authorization bypass via user-controlled key

Source: https://junglewise.ai/threats/cve-2025-1031-utarit-soliclub-authorization-bypass-via-user-controlled-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2025-1031 · Severity: high · CVSS 7.5 · Published 2025-12-18

Utarit SoliClub, a campus and corporate life management application, contains a security flaw that allows unauthorized access to sensitive information. By manipulating specific identifiers or keys within the application, an attacker can bypass security checks to access data they are not permitted to see. This could lead to the exposure of personal user information or the misuse of application features. Users should update to version 5.3.7 or later to resolve this issue.

Technologies: [Utarit Soliclub](https://junglewise.ai/threats/technologies/soliclub). Vendors: [Utarit](https://junglewise.ai/threats/vendors/utarit).

## Quick answers

**Is CVE-2025-1031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-1031 being exploited in the wild.

**How severe is CVE-2025-1031?** High severity, with a CVSS score of 7.5, published 18 December 2025.

**Which products and versions are affected?** Utarit Informatics Services Inc. SoliClub 5.2.4 to 5.3.7.

**Is there a fix for CVE-2025-1031?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-1031 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-1031?** Check whether you run Utarit Soliclub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability exists in Utarit Informatics Services Inc. SoliClub versions 5.2.4 through 5.3.6. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly validate that a user has permission to access a resource identified by a specific key or parameter. A remote, unauthenticated attacker can exploit this by modifying these keys in network requests to access data belonging to other users or perform unauthorized actions. The vulnerability is addressed in version 5.3.7.

## Affected products

- Utarit Informatics Services Inc. SoliClub 5.2.4 to 5.3.7

## Timeline

- 2025-12-18: advisory: Initial disclosure by TR-CERT/USOM
- 2025-12-18: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466)
- [https://www.usom.gov.tr/bildirim/tr-25-0466](https://www.usom.gov.tr/bildirim/tr-25-0466)

## Related threats

- [Utarit SoliClub hard-coded credentials allow authentication abuse](https://junglewise.ai/threats/cve-2025-7358-utarit-soliclub-hard-coded-credentials-allow-authentication-abuse)
- [Utarit Informatics Services SoliClub missing authorization](https://junglewise.ai/threats/cve-2025-7047-utarit-informatics-services-soliclub-missing-authorization)
- [Utarit SoliClub information exposure in query system](https://junglewise.ai/threats/cve-2025-1030-utarit-soliclub-information-exposure-in-query-system)
- [Utarit SoliClub hard-coded credentials in executable](https://junglewise.ai/threats/cve-2025-1029-utarit-soliclub-hard-coded-credentials-in-executable)