# CVE-2025-7047: Utarit Informatics Services SoliClub missing authorization

Source: https://junglewise.ai/threats/cve-2025-7047-utarit-informatics-services-soliclub-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-7047 · Severity: medium · CVSS 4.3 · Published 2025-12-18

A security flaw in the SoliClub application by Utarit Informatics Services Inc. could allow users to perform actions or access information beyond their intended permission levels. SoliClub is a platform used for campus and corporate services like payments and access control. An attacker with a standard user account could exploit this to abuse system privileges, potentially leading to unauthorized data access or misuse of service features.

Technologies: [Utarit Soliclub](https://junglewise.ai/threats/technologies/soliclub). Vendors: [Utarit](https://junglewise.ai/threats/vendors/utarit).

## Quick answers

**Is CVE-2025-7047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7047 being exploited in the wild.

**How severe is CVE-2025-7047?** Medium severity, with a CVSS score of 4.3, published 18 December 2025.

**Which products and versions are affected?** Utarit Informatics Services Inc. SoliClub before 5.3.7.

**Is there a fix for CVE-2025-7047?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-7047 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-7047?** Check whether you run Utarit Soliclub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in Utarit Informatics Services Inc. SoliClub before version 5.3.7. The application fails to properly verify if a user has the necessary permissions to perform specific actions or access certain resources. An attacker authenticated with low-level privileges can exploit this over the network to perform unauthorized operations or escalate their influence within the application. The vulnerability was addressed in version 5.3.7.

## Affected products

- Utarit Informatics Services Inc. SoliClub before 5.3.7

## Timeline

- 2025-12-18: disclosed
- 2025-12-18: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466)
- [https://www.usom.gov.tr/bildirim/tr-25-0466](https://www.usom.gov.tr/bildirim/tr-25-0466)

## Related threats

- [Utarit SoliClub hard-coded credentials allow authentication abuse](https://junglewise.ai/threats/cve-2025-7358-utarit-soliclub-hard-coded-credentials-allow-authentication-abuse)
- [Utarit SoliClub authorization bypass via user-controlled key](https://junglewise.ai/threats/cve-2025-1031-utarit-soliclub-authorization-bypass-via-user-controlled-key)
- [Utarit SoliClub information exposure in query system](https://junglewise.ai/threats/cve-2025-1030-utarit-soliclub-information-exposure-in-query-system)
- [Utarit SoliClub hard-coded credentials in executable](https://junglewise.ai/threats/cve-2025-1029-utarit-soliclub-hard-coded-credentials-in-executable)