CVE-2026-1019: Gotac Police Statistics Database System missing authentication

CVE-2026-1019 · Severity: info · CVSS 9.8 · Published 2026-01-16

The Gotac Police Statistics Database System contains a critical security flaw where it fails to verify user identity for certain functions. This allows unauthorized individuals to remotely access the system and read, change, or delete sensitive police database records. Such an exploit could lead to significant data breaches, loss of critical law enforcement information, and compromised operational integrity.

Technologies: Gotac Police Statistics Database System. Vendors: Gotac.

Quick answers

Is CVE-2026-1019 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-1019 being exploited in the wild.
How severe is CVE-2026-1019?
Informational severity, with a CVSS score of 9.8, published 16 January 2026.
Which products and versions are affected?
Gotac Police Statistics Database System up to and including 1.0.3.
Is there a fix for CVE-2026-1019?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1019 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1019?
Check whether you run Gotac Police Statistics Database System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the Gotac Police Statistics Database System through version 1.0.3. The flaw is located within specific system functionalities that do not require valid credentials before granting access to database operations. An unauthenticated attacker can exploit this over the network to perform CRUD (Create, Read, Update, Delete) operations on the underlying database. Although the CVE was later marked as rejected by the CNA, the original technical disclosure from TWCERT/CC identified the impact as a total compromise of confidentiality, integrity, and availability.

Affected products

  • Gotac Police Statistics Database System up to and including 1.0.3

Timeline

  • 2026-01-15: disclosed: Original disclosure by TWCERT/CC
  • 2026-01-16: advisory: NVD publication date
  • 2026-07-30: other: CVE rejected/withdrawn by CNA

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.