by Kastro
Paper/Archive/CVE-2026-31271

CVE-2026-31271

mitre — megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality.

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.2.462 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md