CVE-2026-31151 is a critical authentication bypass (CVSS 9.8) in the login mechanism of Kaleris Yard Management Solutions version 7.2.2.1. It lets an attacker reach application resources without valid login verification. The record names no fixed version, so contact Kaleris.
What's affected
The record names Kaleris YMS version 7.2.2.1. It does not state a fixed version or whether other versions are affected.
How to check if you're exposed
Ask your YMS administrator which version you run, or read it from the application's About page. If you run 7.2.2.1, treat it as exposed.
Check whether the application is reachable from outside the corporate network, and review authentication logs for access that has no matching login event.
What to do now
- Contact Kaleris support for a patched version or mitigation guidance.
- Put the application behind a VPN or an access proxy that enforces its own authentication.
- Review logs for unexplained access to application resources.
- Restrict who on the network can reach the service.
Why it matters
The weakness class is CWE-288, authentication bypass using an alternate path or channel. Some route into the application does not go through the intended check, so access is granted without it.
The record is brief and the vendor has not published details I could confirm. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why put another login in front?
A proxy that requires its own sign in keeps unauthenticated traffic away from the application while no patch exists.
Sources
Last reviewed: 19 October 2026.
