CVE-2026-6208: IDOR in in HAVELSAN's Geographic Tracking System

Synopsis

An insecure direct object reference (IDOR) vulnerability exists in HAVELSAN Inc.'s Geographic Tracking System. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any internet-reachable instance is exposed to unauthenticated attackers. Successful exploitation allows an attacker to read and modify data the system manages, bypassing authorization controls entirely. A patched-image rebuild at v0.0.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; any internet-exposed or internally networked instance is within reach of the attacker.

• AuthenticationNot required

  No credentials or prior account access are needed; the attacker can send crafted requests as an unauthenticated user.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is required; the attacker operates entirely without user participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker reads tracking records, location histories, and other confidential data managed by the system by substituting user-controlled object identifiers in requests.
• An attacker modifies or overwrites tracking entries and geographic data belonging to other users or organizations by referencing their object identifiers directly.
• Authorization controls are bypassed wholesale, so any object the system manages is accessible or editable without privilege checks.