CVE-2026-22788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22788", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.388Z", "datePublished": "2026-01-12T21:40:11.913Z", "dateUpdated": "2026-01-13T19:08:34.529Z"}, "containers": {"cna": {"title": "WebErpMesv2 allows unauthenticated API Access", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w"}, {"name": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23", "tags": ["x_refsource_MISC"], "url": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23"}], "affected": [{"vendor": "SMEWebify", "product": "WebErpMesv2", "versions": [{"version": "< 1.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T21:48:51.265Z"}, "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19."}], "source": {"advisory": "GHSA-pp68-5pc2-hv7w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:14:45.621333Z", "id": "CVE-2026-22788", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:08:34.529Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22788", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:14:45.621333Z"}}}], "references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:14:47.801Z"}}], "cna": {"title": "WebErpMesv2 allows unauthenticated API Access", "source": {"advisory": "GHSA-pp68-5pc2-hv7w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "SMEWebify", "product": "WebErpMesv2", "versions": [{"status": "affected", "version": "< 1.19"}]}], "references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "name": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23", "name": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T21:48:51.265Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22788", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:08:34.529Z", "dateReserved": "2026-01-09T18:27:19.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T21:40:11.913Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WebErpMesv2", "vendor": "SMEWebify", "versions": [{"status": "affected", "version": "< 1.19"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wem-project:wem:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8FFED4C-1ACD-4922-99EB-4951BD1C6B8E", "versionEndExcluding": "1.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19."}, {"lang": "es", "value": "WebErpMesv2 es un sistema web de gesti\u00f3n de recursos y ejecuci\u00f3n de fabricaci\u00f3n para la industria. Antes de la 1.19, la aplicaci\u00f3n WebErpMesV2 expone m\u00faltiples puntos finales de API sensibles sin middleware de autenticaci\u00f3n. Un atacante remoto no autenticado puede leer datos cr\u00edticos para el negocio, incluyendo empresas, cotizaciones, pedidos, tareas y pizarras. Acceso de escritura limitado permite la creaci\u00f3n de registros de empresas y la manipulaci\u00f3n completa de pizarras de colaboraci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la 1.19."}], "id": "CVE-2026-22788", "lastModified": "2026-06-17T10:20:25.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22788", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:14:45.621333Z", "version": "2.0.3"}}]}, "published": "2026-01-12T22:16:08.343", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:58:05.192047+00:00", "value": {"mitigation_remediation": ["Upgrade WebErpMesv2 to version 1.19 or later, which implements authentication middleware for all API endpoints.", "If an upgrade cannot yet be performed, restrict access to the API endpoints by firewall rules or enforce VPN usage to limit exposure to trusted hosts.", "Ensure that after upgrades or network restriction, all API endpoints require proper authentication and authorization; disable or remove any unused APIs to reduce attack surface."], "summary": {"action": "Patch Now", "impact": "Unauthenticated remote access to sensitive API endpoints exposing business\u2011critical data and limited write capabilities"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SMEWebify WebErpMesv2 application in all releases prior to version 1.19. No specific patch level is provided beyond the recommendation to upgrade to 1.19 or later. The vendor product is identified as WebErpMesv2 and the affected vendor is SMEWebify.", "description_and_impact": "The WebErpMesv2 system exposes a number of API endpoints without any authentication middleware, allowing an unauthenticated remote attacker to retrieve sensitive business data such as company profiles, quotes, orders, tasks, and collaboration whiteboards. In addition, the system permits limited write operations that enable the creation of new company records and full manipulation of collaboration whiteboards. This lack of authentication constitutes a significant confidentiality and integrity breach, giving a malicious actor broad visibility and control over critical operational data.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity. An EPSS score of less than 1% suggests that the likelihood of active exploitation in the field is currently low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network, as the exposed API endpoints are reachable without authentication. An attacker can trigger the exploit by sending HTTP requests to any of the vulnerable endpoints, resulting in data disclosure or state modification. Although no publicly documented exploits exist, the high impact warrants immediate attention."}}}}, "created": "2026-04-18T07:00:11.354567+00:00", "updated": "2026-04-18T07:00:11.354578+00:00", "vendors": []}