CVE-2024-3306 is a high severity (CVSS 7.5) authorization bypass through a user controlled key in the Utarit Information SoliClub apps, allowing exploitation of incorrectly configured access control. The record says iOS before 4.4.0 and Android before 5.2.1 are affected, so update both.
What's affected
SoliClub from Utarit Information: iOS versions before 4.4.0 and Android versions before 5.2.1. The record cites Turkish national advisory TR-24-1457 on the USOM site. The page we fetched had no readable text, so the details come from the NVD description.
This CVE shares its advisory and version bounds with CVE-2024-3305. The two differ in wording: CVE-2024-3305 describes retrieval of embedded sensitive data, and this one describes exploiting incorrectly configured access control levels. The weakness class, CWE-639, is the same.
The weakness class: CWE-639, authorization bypass through a user controlled key. The NVD record scores it 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Check the installed app version against 4.4.0 on iOS or 5.2.1 on Android, either on the device or through mobile device management. Operators of the service should ask the vendor for confirmation of the server side change.
What to do now
- Update the apps to the fixed versions.
- Ask the vendor how access control is now enforced on the server.
- Read advisory TR-24-1457.
- Handle both SoliClub CVEs as one remediation.
Why it matters
User controlled key flaws are common in mobile backends because the app sends an identifier, and the server forgets to check who is asking. The fix has to live in the server logic, and it is worth testing: request a record that belongs to another test account and confirm that it is refused.
Two CVEs from one advisory with different wording are best read as two faces of the same design gap, and not as two separate fixes.
Quick check
Why are there two SoliClub CVEs?
The advisory covers two related authorization problems that were assigned separate identifiers: one framed around retrieving sensitive data and one framed around incorrectly configured access control. Both are fixed in the same app versions per the record.
Sources
- USOM advisory TR-24-1457 (listed in the record; page text could not be read)
- Safeguard Gold entry for CVE-2024-3306
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
