# CVE-2025-7016: Akın Software QR Menu improper access control

Source: https://junglewise.ai/threats/cve-2025-7016-ak-n-software-qr-menu-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-29. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-7016 · Severity: high · CVSS 8 · Published 2026-01-29

Akın Software's QR Menu, a digital menu system used by restaurants and hospitality businesses, contains a security flaw in how it manages user permissions. An attacker could exploit this to bypass authentication and gain unauthorized access to the system's administrative or sensitive functions. This could lead to the unauthorized modification of menu data, exposure of business information, or disruption of restaurant operations.

## Quick answers

**Is CVE-2025-7016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7016 being exploited in the wild.

**How severe is CVE-2025-7016?** High severity, with a CVSS score of 8, published 29 January 2026.

**Which products and versions are affected?** Akın Software Computer Import Export Industry and Trade Ltd. QR Menu before s1.05.12.

**Is there a fix for CVE-2025-7016?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-7016 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-7016?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) in Akın Software QR Menu allows for authentication abuse. The flaw exists in the application's permission logic, enabling an attacker to bypass standard authentication checks. According to the CNA, the attack requires low privileges and some user interaction, though NIST's analysis suggests it may be exploitable without any privileges. Successful exploitation allows an attacker to gain unauthorized access to sensitive data or administrative functions. The vulnerability is resolved in version s1.05.12.

## Affected products

- Akın Software Computer Import Export Industry and Trade Ltd. QR Menu before s1.05.12

## Timeline

- 2026-01-29: disclosed
- 2026-01-29: advisory
- 2026-06-05: other: Advisory updated with enriched data

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0006](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0006)
- [https://www.usom.gov.tr/bildirim/tr-26-0006](https://www.usom.gov.tr/bildirim/tr-26-0006)