CVE-2024-4259 describes a missing authorization vulnerability in SAMPAŞ Holding's AKOS platform, affecting AkosCepVatandasService versions before 2.0 and TahsilatService versions before 1.0.7. The vulnerability allows unauthorized data collection due to lack of proper access control (CWE-862). The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality and integrity with low scope and impact metrics. No official patch or vendor advisory is currently available, and no known exploitation has been reported.

The vulnerability permits unauthorized users to collect data from the affected AKOS services, potentially exposing user-provided information. This could lead to partial confidentiality and integrity loss. However, the impact is limited by the medium severity score and the absence of known active exploitation. The lack of required privileges and user interaction increases the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected services where possible and monitor for unusual data access patterns. Follow vendor updates closely for any forthcoming patches or official mitigation instructions.