PT-2026-20544 · Googtech · Sms-Ssm

Jszdk · Publicado 2026-02-18 · Atualizado 2026-02-19 · CVE-2026-2676

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GoogTech sms-ssm versions prior to e8534c766fd13f5f94c01dab475d75f286918a8d

Description A weakness exists due to improper authorization. This issue is related to the preHandle function within the LoginInterceptor.java file of the API Interface component. The attack can be performed remotely. The exploit has been made publicly available.

Recommendations Update to a version prior to e8534c766fd13f5f94c01dab475d75f286918a8d.

Exploit

Correção

Improper Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-285

CWE-266

Identificadores relacionados

CVE-2026-2676

Produtos afetados

Sms-Ssm

Referências · 10

• 🔥 https://github.com/GoogTech/sms-ssm/issues/27#issue-3878817166 · Exploit
• https://github.com/GoogTech/sms-ssm/issues/27#issuecomment-3828063958 · Nota
• https://github.com/GoogTech/sms-ssm/issues/27 · Nota
• https://vuldb.com/?submit.749702 · Nota
• https://t.me/CVEtracker/45038 · Publicação no Telegram
• https://vuldb.com/?id.346469 · Nota
• https://vuldb.com/?ctiid.346469 · Nota
• https://github.com/GoogTech/sms-ssm · Nota
• https://twitter.com/CVEnew/status/2024258056272695651 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2676 · Nota de Segurança