Is CVE-2026-6792 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6792 being exploited in the wild.

How severe is CVE-2026-6792?

Medium severity, with a CVSS score of 6.5, published 21 July 2026.

Which products and versions are affected?

Universal Software Inc. FlexCity 5.536.0 through 11052026.

Is there a fix for CVE-2026-6792?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6792 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6792?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6792: Universal Software Inc. FlexCity missing authorization in access control

CVE-2026-6792 · Severity: medium · CVSS 6.5 · Published 2026-07-21

A security flaw has been identified in Universal Software Inc. FlexCity, a platform used for smart city management and urban automation. The vulnerability involves a failure to properly check user permissions, which could allow an authorized user to access sensitive information they are not supposed to see. This could lead to the exposure of private city data or administrative records, potentially impacting operational privacy and data security.

Quick answers

Is CVE-2026-6792 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6792 being exploited in the wild.
How severe is CVE-2026-6792?: Medium severity, with a CVSS score of 6.5, published 21 July 2026.
Which products and versions are affected?: Universal Software Inc. FlexCity 5.536.0 through 11052026.
Is there a fix for CVE-2026-6792?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6792 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6792?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in Universal Software Inc. FlexCity versions 5.536.0 through 11052026. The flaw stems from incorrectly configured access control security levels, which fail to properly validate user permissions for specific actions or data requests. An attacker with low-privileged network access can exploit this to gain unauthorized access to sensitive information (High Confidentiality impact). The attack vector is network-based and does not require user interaction, though it does require basic authenticated access (PR:L).

Affected products

Universal Software Inc. FlexCity 5.536.0 through 11052026

Timeline

2026-07-21: advisory: NVD published the vulnerability details.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0593

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.