CVE-2026-11340 describes a missing authorization vulnerability (CWE-862) in HAVELSAN Inc.'s Liman MYS product. The vulnerability allows users with limited privileges to access functionality that should be restricted by ACLs but is not properly enforced. This can lead to unauthorized actions impacting the system's integrity and availability. The affected versions are those before release.Master.1107. No patch or official remediation level has been disclosed yet, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows unauthorized access to restricted functionality, potentially leading to unauthorized modification or disruption of system operations. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, with low confidentiality impact but high integrity and availability impacts. This means an attacker with some privileges can cause significant damage or disruption without needing user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HAVELSAN Inc. advisories for updates. Until a fix is available, restrict access to Liman MYS to trusted users and networks to minimize exposure.