# CVE-2026-11340: HAVELSAN Liman MYS missing authorization in ACLs

Source: https://junglewise.ai/threats/cve-2026-11340-havelsan-liman-mys-missing-authorization-in-acls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-11340 · Severity: high · CVSS 8.3 · Published 2026-07-07

HAVELSAN Liman MYS, a centralized management system used for IT infrastructure, contains a security flaw where access controls are not properly enforced. This allows an authenticated user to access sensitive administrative functions or data that should normally be restricted. An exploit could lead to unauthorized changes to the system configuration or disruption of managed IT services.

Technologies: [HAVELSAN Liman MYS](https://junglewise.ai/threats/technologies/liman-mys). Vendors: [HAVELSAN](https://junglewise.ai/threats/vendors/havelsan).

## Quick answers

**Is CVE-2026-11340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11340 being exploited in the wild.

**How severe is CVE-2026-11340?** High severity, with a CVSS score of 8.3, published 7 July 2026.

**Which products and versions are affected?** HAVELSAN Liman MYS before release.Master.1107.

**Is there a fix for CVE-2026-11340?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11340 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11340?** Check whether you run HAVELSAN Liman MYS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in HAVELSAN Liman MYS prior to version release.Master.1107. The application fails to properly validate user permissions against Access Control Lists (ACLs) for certain functional endpoints. An attacker with low-privileged network access can bypass these checks to execute restricted commands or access sensitive management features. This can result in high impacts to system integrity and availability. The vulnerability is addressed in version release.Master.1107.

## Affected products

- HAVELSAN Inc. Liman MYS before release.Master.1107

## Timeline

- 2026-07-07: advisory: Published by NVD and TR-CERT

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504)

## Related threats

- [HAVELSAN Liman MYS path traversal](https://junglewise.ai/threats/cve-2026-105457-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [HAVELSAN Liman MYS weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-94380-weak-password-recovery-mechanism-for-forgotten-password)
- [HAVELSAN Liman MYS path traversal](https://junglewise.ai/threats/cve-2026-19532-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [HAVELSAN Liman MYS LDAP injection](https://junglewise.ai/threats/cve-2026-13696-havelsan-liman-mys-ldap-injection)
- [HAVELSAN Liman MYS improper cryptographic signature verification](https://junglewise.ai/threats/cve-2026-11348-havelsan-liman-mys-improper-cryptographic-signature-verification)