PT-2026-2307 · Unknown · Weberpmesv2

Nedlir · Published 2026-01-12 · Updated 2026-01-21 · CVE-2026-22788

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.19

Description The WebErpMesv2 application lacks authentication middleware for multiple sensitive API endpoints. This allows an unauthenticated remote attacker to read business-critical data, including companies, quotes, orders, tasks, and whiteboards. Limited write access permits the creation of company records and full manipulation of collaboration whiteboards. The affected API endpoints include those for accessing company data, quotes, orders, tasks, and whiteboards.

Recommendations Update to version 1.19 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-22788

GHSA-PP68-5PC2-HV7W

Affected Products

Weberpmesv2

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22788.json · Exploit
• 🔥 https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w · Exploit
• https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23 · Patch
• https://osv.dev/vulnerability/CVE-2026-22788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22788 · Security Note
• https://twitter.com/VulmonFeeds/status/2010924598297014547 · Twitter Post
• https://twitter.com/CVEnew/status/2010832528509170099 · Twitter Post
• https://t.me/cveNotify/149441 · Telegram Post