CVE-2026-13138: CWE-602 Client-Side Enforcement of Server-Side Security in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform

This vulnerability (CVE-2026-13138) in the Biletiva Ticketing Platform arises from improper enforcement of security controls on the client side instead of the server side, classified under CWE-602. This design flaw allows an attacker to manipulate the application state, potentially leading to unauthorized actions or data integrity violations. The vulnerability affects all versions up to and including 2026-07-23. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. The impact includes low confidentiality loss, high integrity loss, and low availability loss.

An attacker can remotely manipulate the application state due to client-side enforcement of security controls that should be enforced on the server. This can lead to unauthorized modifications compromising data integrity, with some confidentiality and availability impact. No known exploits are reported in the wild.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious and monitor for updates from Divasoft Software and E-Commerce Inc.