CVE-2025-7016 is a high severity improper access control flaw (CVSS 8.0) in Akin Software QR Menu, versions before s1.05.12. It allows authentication abuse. Update to s1.05.12 or later, and review which accounts hold which rights on your menu sites and who still needs them.
What's affected
- Akin Software (Akinsoft) QR Menu before s1.05.12.
- Fixed version: s1.05.12, based on the affected range in the record. Confirm in notice TR-26-0006.
How to check if you're exposed
Read the QR Menu version from the admin area or your vendor's records. Anything before s1.05.12 is in scope.
Then list the accounts that can sign in, and the rights each has. Access control flaws matter most where many accounts exist with different privileges.
What to do now
- Check the version of QR Menu on every site you run.
- Update to s1.05.12 or later.
- Remove stale accounts and reduce rights to what each person needs.
- Review recent changes to menus, prices and settings for unexpected edits.
- Check notice TR-26-0006 for anything further.
Small web apps for restaurants and shops often share one admin login among several staff. Give each person their own account, so that you can remove access when someone leaves and see who changed what. That habit reduces the effect of any access control flaw, including this one.
Why it matters
The weakness is CWE-284, improper access control. The application does not reliably enforce who may do what, so a user can reach actions or data outside their role.
The vector needs a logged in user and some interaction, with high impact on confidentiality, integrity and availability. The record gives no technical detail beyond the class, so this post does not add any. It shares notice TR-26-0006 with CVE-2025-7015. The record does not list this CVE as exploited in the wild.
Quick check
Do CVE-2025-7015 and CVE-2025-7016 have the same fix?
Both are listed as affecting QR Menu before s1.05.12 under notice TR-26-0006, so updating to s1.05.12 or later addresses the stated range.
Sources
- https://www.usom.gov.tr/bildirim/tr-26-0006
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0006
Last reviewed: 19 October 2026.
