The vulnerability identified as CVE-2026-13724 concerns improper reliance on client-side enforcement of security controls that should be enforced on the server side within the Corporate Training Management System by Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. This weakness (CWE-602) permits an attacker with low privileges to manipulate input data, potentially bypassing intended security restrictions. The affected versions are those prior to the commit identified as dd1a9df64. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows an attacker with low privileges to manipulate input data by bypassing server-side security enforcement through client-side controls. This can lead to unauthorized modification of data integrity within the affected system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported, limiting observed real-world impact.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should be cautious about trusting client-side security enforcement and consider additional server-side validation where possible.