CVE-2024-3305 is a high severity (CVSS 7.5) authorization bypass through a user controlled key, with missing authorization, in the Utarit Information SoliClub apps. It allows retrieval of embedded sensitive data. The record says iOS before 4.4.0 and Android before 5.2.1 are affected, so update both.
What's affected
SoliClub from Utarit Information: iOS versions before 4.4.0 and Android versions before 5.2.1, per the record. The record cites a Turkish national cyber security advisory, TR-24-1457, published through USOM and the Cyber Security Presidency. We fetched the USOM page, but it rendered as a styled shell with no readable advisory text, so the version bounds come from the NVD description.
The weaknesses are CWE-639 and a missing authorization class. No exploitation is recorded, and the record is not on the CISA list.
CVE-2024-3306 comes from the same advisory and the same version bounds.
The weakness class: CWE-639, authorization bypass through a user controlled key; CWE-862, missing authorization. The NVD record scores it 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: this CVE carries two CWEs (639 and 862) in the record, while CVE-2024-3306 from the same advisory lists only CWE-639. Both score 7.5.
How to check if you're exposed
On a phone, open the app store listing for SoliClub and compare the installed version with 4.4.0 (iOS) or 5.2.1 (Android). In a managed fleet, use your mobile device management inventory to list installed app versions. If you operate the SoliClub backend, check with the vendor which API versions enforce the fix.
What to do now
- Update SoliClub to 4.4.0 or later on iOS and 5.2.1 or later on Android.
- If you run the service, confirm with Utarit Information that server side authorization checks are in place.
- Read advisory TR-24-1457 directly on the USOM site.
- Treat data tied to old app versions as possibly exposed and review what that data includes.
Why it matters
CWE-639 describes authorization decisions that trust a key the user can change, such as an identifier in a request. If the server does not check that the caller owns the record, changing the identifier returns someone else's data.
These flaws are fixed on the server side as much as in the app, and a patched client does not guarantee safe data. That is why the advisory and the vendor statement matter more than the app version alone.
Quick check
Does updating the app protect data that was already exposed?
No. An update stops the app from being used with the flawed behavior, but data already retrieved cannot be recalled. Ask the vendor what logging exists and whether affected users are being notified.
Sources
- USOM advisory TR-24-1457 (listed in the record; page text could not be read)
- Safeguard Gold entry for CVE-2024-3305
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
