CVE-2026-2860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2860", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-20T13:56:17.368Z", "datePublished": "2026-02-21T04:32:06.851Z", "dateUpdated": "2026-02-24T15:37:22.550Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T04:32:06.851Z"}, "title": "feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "feng_ha_ha", "product": "ssm-erp", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "feng_ha_ha", "product": "production_ssm", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "megagao", "product": "ssm-erp", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}, {"vendor": "megagao", "product": "production_ssm", "versions": [{"version": "4288d53bd35757b27f2d070057aefb2c07bdd097", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T15:18:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Jszdk (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347100", "name": "VDB-347100 | feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.347100", "name": "VDB-347100 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.754494", "name": "Submit #754494 | https://github.com/megagao/production_ssm production_ssm v1.0 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/megagao/production_ssm/issues/36", "tags": ["issue-tracking"]}, {"url": "https://github.com/megagao/production_ssm/issues/36#issue-3914626431", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T15:36:51.853178Z", "id": "CVE-2026-2860", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:37:22.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2860", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T15:36:51.853178Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T15:37:15.811Z"}}], "cna": {"title": "feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Jszdk (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "feng_ha_ha", "product": "ssm-erp", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "feng_ha_ha", "product": "production_ssm", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "megagao", "product": "ssm-erp", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"vendor": "megagao", "product": "production_ssm", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T15:18:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347100", "name": "VDB-347100 | feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.347100", "name": "VDB-347100 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.754494", "name": "Submit #754494 | https://github.com/megagao/production_ssm production_ssm v1.0 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://github.com/megagao/production_ssm/issues/36", "tags": ["issue-tracking"]}, {"url": "https://github.com/megagao/production_ssm/issues/36#issue-3914626431", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T04:32:06.851Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2860", "state": "PUBLISHED", "dateUpdated": "2026-02-24T15:37:22.550Z", "dateReserved": "2026-02-20T13:56:17.368Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-21T04:32:06.851Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ssm-erp", "vendor": "feng_ha_ha", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "production_ssm", "vendor": "feng_ha_ha", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "ssm-erp", "vendor": "megagao", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}, {"product": "production_ssm", "vendor": "megagao", "versions": [{"status": "affected", "version": "4288d53bd35757b27f2d070057aefb2c07bdd097"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en feng_ha_ha/megagao ssm-erp y production_ssm hasta 4288d53bd35757b27f2d070057aefb2c07bdd097. Afectada es una funci\u00f3n desconocida del archivo EmployeeController.java. La manipulaci\u00f3n conduce a una autorizaci\u00f3n indebida. Es posible iniciar el ataque remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto est\u00e1 utilizando una versi\u00f3n continua para proporcionar entrega continua. Por lo tanto, no hay detalles de versi\u00f3n disponibles para las versiones afectadas ni actualizadas. Este producto se distribuye bajo dos nombres completamente diferentes. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero a\u00fan no ha respondido."}], "id": "CVE-2026-2860", "lastModified": "2026-06-17T10:31:54.227", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2860", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T15:36:51.853178Z", "version": "2.0.3"}}]}, "published": "2026-02-21T05:17:30.210", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/megagao/production_ssm/issues/36"}, {"source": "cna@vuldb.com", "url": "https://github.com/megagao/production_ssm/issues/36#issue-3914626431"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347100"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347100"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.754494"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4288d53bd35757b27f2d070057aefb2c07bdd097"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "production_ssm", "source": "cna", "vendor": "feng_ha_ha"}, "product": "production_ssm", "vendor": "megagao"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4288d53bd35757b27f2d070057aefb2c07bdd097"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ssm-erp", "source": "cna", "vendor": "megagao"}, "product": "ssm-erp", "vendor": "megagao"}], "analysis": {"en": {"generated_at": "2026-04-17T16:55:41.811423+00:00", "value": {"mitigation_remediation": ["Check the project\u2019s issue tracker for a fix commit and upgrade to a version that includes the remediation once it becomes available", "Restrict access to the EmployeeController endpoints by implementing temporary authorization filters or role checks if the application configuration allows it", "Continuously monitor application logs and user activity for signs of unauthorized access attempts to the affected controller"], "summary": {"action": "Assess Impact", "impact": "Improper Authorization"}, "threat_synthesis": {"affected_systems": "Affected products include production_ssm and ssm-erp from both feng_ha_ha and megagao. No fixed version information is provided; the projects use a rolling release model and the specific affected commit is identified only by an older Git hash. Users running any pre\u2011update release before the fix commit are potentially vulnerable.", "description_and_impact": "The vulnerability resides in EmployeeController.java of the production_ssm and ssm-erp projects, allowing an attacker to manipulate requests and bypass authorization checks. This flaw is caused by missing or incorrect enforcement of access controls, representing CWE-266 and CWE-285 weaknesses. The attacker can gain unauthorized access to sensitive resources or perform privileged operations, thereby compromising confidentiality, integrity, and potentially availability of the application.", "risk_and_exploitability": "With a CVSS score of 5.3 and an EPSS score below 1%, this issue is of medium severity and is currently not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack requires remote interaction but no authentication is mentioned, implying that the flaw can be abused by anonymous users. The risk remains moderate but requires monitoring, as the flaw permits unauthorized actions without a patch."}}}}, "created": "2026-02-23T14:32:47.480426+00:00", "updated": "2026-04-17T17:00:10.190856+00:00", "vendors": ["megagao", "megagao$PRODUCT$production_ssm", "megagao$PRODUCT$ssm-erp"]}