CVE-2025-7013 is a medium severity authorization bypass (CVSS 5.7) in the QR Menu Pro Smart Menu Systems Menu Panel, through version 29012026. The vendor did not respond to the disclosure, and no fix is listed. Limit exposure and contact the vendor for status.
What's affected
- QR Menu Pro Smart Menu Systems Menu Panel through 29012026.
- Fixed version: none listed. The record says the vendor did not respond to early contact.
How to check if you're exposed
Find the Menu Panel version in your admin area or in your contract and invoice records. A build dated 29012026 or earlier is in scope. If the vendor hosts the panel for you, ask them in writing whether it is fixed.
Then review who uses the panel and how. The vector needs a logged in user and some interaction, so the exposure is mostly accounts you issue to staff or partners.
What to do now
- Ask the vendor in writing for a fix and a date, and keep the reply.
- Review all accounts on the panel and remove those no longer needed.
- Use unique strong passwords and, if offered, multi factor authentication.
- Watch panel activity for edits you do not recognize.
- Plan an alternative if the vendor stays silent.
With a silent vendor, document your own attempts to reach them, the date, and what you were told. That record helps with internal risk acceptance and with any later decision to switch. Ask whether the vendor has a security contact, and check the national CERT notice for updates.
Why it matters
The weakness is CWE-639, authorization bypass through a user-controlled key. The application uses an identifier supplied by the user, such as a record number, to find an object, without checking that the user is allowed to access that object. Changing the identifier then reaches someone else's data.
The score is moderate, with high confidentiality impact only. For a menu system the exposed data may be limited, but business details and customer information are possible. The record does not list this CVE as exploited in the wild, and the disclosure came through the Turkish national CERT.
Quick check
Is a fix available for CVE-2025-7013?
The record lists none and says the vendor did not respond. Limit access and ask the vendor.
Sources
- https://www.usom.gov.tr/bildirim/tr-26-0007
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0007
Last reviewed: 19 October 2026.
