Global IT Weoll Update Fixes SSRF Token Disclosure
Tech GuruQuick Answer
TR-CERT identifies server-side request forgery in Weoll releases before 3.2.45.44. Its CVE-2026-77112 record names JWT token disclosure as the consequence: an induced server request can cross a trust boundary and expose authentication material. The public description does not identify the exact endpoint or token flow, so this notice does not claim a reproduced token theft or a universal account takeover.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Global IT Weoll releases before 3.2.45.44, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Source recheck: October 2, 2026 UTC, against TR-CERT's structured CVE record. The token-disclosure title and version boundary are source-checked; endpoint-specific behavior remains undocumented in the accessible public body.
Scope And Authority
| Product scope | Global IT Weoll releases before 3.2.45.44 |
|---|---|
| Advisory | TR-26-1160 |
| CVE | CVE-2026-77112 |
| Authoritative release date | 2026-09-23 12:02:00.000 UTC |
| Authority revision date | 2026-09-23 12:39:30.130 UTC |
| Affected versions | Global IT Weoll releases before 3.2.45.44 |
| Fixed version | Global IT Weoll 3.2.45.44 or later |
| CVSS base score | 6.5 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The published CVSS vector requires user interaction but no attacker privileges. Treat server-side network access and token handling as the relevant review areas, without inventing a request payload from the short advisory. Use the vendor-supported update and review unexpected outbound requests through the incident process; absence of such logs is not proof that no disclosure occurred.
What To Validate Now
- Inventory. Record Weoll build, deployment owner, enabled server-side fetch integrations, outbound network policy and where authentication tokens may appear in operational logs.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Global IT Weoll releases before 3.2.45.44 Do not infer applicability from product family or severity alone.
- Remediate. Apply Global IT Weoll 3.2.45.44 or later through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. In authorized staging, use a harmless test destination and synthetic credentials to verify intended outbound-request boundaries and normal integrations. Do not retrieve production tokens or copy them into evidence tickets; record redacted event identifiers instead.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
