CVE-2025-15025: Yordam Library Automation System authorization bypass via user-controlled key

CVE-2025-15025 · Severity: high · CVSS 8.8 · Published 2026-05-14

A security vulnerability has been identified in the Yordam Library Automation System, a platform used to manage library resources and member data. An attacker can bypass security checks by manipulating specific identifiers, potentially gaining unauthorized access to sensitive information or administrative functions. This could lead to the exposure of patron data or unauthorized changes to the library's digital records.

Technologies: Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System. Vendors: Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc..

Quick answers

Is CVE-2025-15025 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-15025 being exploited in the wild.
How severe is CVE-2025-15025?
High severity, with a CVSS score of 8.8, published 14 May 2026.
Which products and versions are affected?
Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System v.21.6 to v.22.1.
Is there a fix for CVE-2025-15025?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15025 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-15025?
Check whether you run Yordam Information Technology Consulting or Training and Electronic Systems Industry and Trade Inc. Library Automation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It exists in the Yordam Library Automation System between versions 21.6 and 22.1. The flaw allows a remote attacker to bypass authorization mechanisms by manipulating trusted identifiers (such as IDs or keys) within the application's requests. While the attack vector is network-based and requires low complexity, the CVSS metric indicates that user interaction is required. Successful exploitation allows the attacker to view, modify, or delete data they are not authorized to access. The issue is addressed in version 22.1.

Affected products

  • Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System v.21.6 to v.22.1

Timeline

  • 2026-05-14: advisory: NVD published the CVE record based on TR-CERT data.
  • 2026-05-14: disclosed: Vulnerability disclosed by the Computer Emergency Response Team of the Republic of Turkey.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.