CVE-2026-31271

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-31271", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-09T14:01:47.982Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-07T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-07T17:21:35.549Z"}, "descriptions": [{"lang": "en", "value": "megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-288", "lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T14:00:35.332320Z", "id": "CVE-2026-31271", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:01:47.982Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-31271", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T14:00:35.332320Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:01:41.858Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md"}], "descriptions": [{"lang": "en", "value": "megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-07T17:21:35.549Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31271", "state": "PUBLISHED", "dateUpdated": "2026-04-09T14:01:47.982Z", "dateReserved": "2026-03-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-07T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise."}], "id": "CVE-2026-31271", "lastModified": "2026-06-17T10:33:33.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31271", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T14:00:35.332320Z", "version": "2.0.3"}}]}, "published": "2026-04-07T18:16:41.000", "references": [{"source": "cve@mitre.org", "url": "https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "production_ssm", "vendor": "megagao"}], "analysis": {"en": {"generated_at": "2026-04-10T11:52:16.836095+00:00", "value": {"mitigation_remediation": ["Apply the latest patch or upgrade megagao production_ssm to a release that implements authentication checks for the /user/insert endpoint.", "If a patch is unavailable, restrict access to the /user/insert endpoint using network ACLs or a web application firewall to block unauthenticated requests.", "Audit all existing user accounts to locate and remove any super administrator accounts created through this vulnerability.", "Enforce the principle of least privilege by reviewing role assignments and limiting super administrator rights to essential personnel only.", "Monitor application logs for attempts to access /user/insert and alert on unauthenticated usage patterns."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation \u2013 Unauthenticated Creation of Super Administrator Accounts"}, "threat_synthesis": {"affected_systems": "The flaw exists in megagao production_ssm version 1.0. No vendor or product details beyond that version are supplied.", "description_and_impact": "An authorization bypass flaw allows an attacker to call the /user/insert endpoint without any authentication. The insert() method in UserController.java lacks checks for the caller\u2019s identity, so any entity can add a user record with super administrator rights. This weakness is categorized as CWE\u2011288. The ability to create a privileged account grants the attacker full system control, enabling configuration changes, data exfiltration, persistence, and any other actions a super admin can perform.", "risk_and_exploitability": "The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score of less than 1% indicates that exploitation has not yet been observed widely, and it has not entered the CISA KEV catalog. The likely attack vector is a remote HTTP POST to /user/insert, which can be executed from anywhere that can reach the exposed endpoint, resulting in immediate system compromise."}}}}, "created": "2026-04-08T19:50:23.761558+00:00", "title": "Privilege Escalation via Unauthenticated Super Admin Creation in megagao production_ssm v1.0", "updated": "2026-04-13T14:27:25.996612+00:00", "vendors": ["megagao", "megagao$PRODUCT$production_ssm"]}