PT-2026-30937 · Undefined · Undefined

Clockw1Se0V0 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-31271

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

megagao production ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-31271

Affected Products

Undefined

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-31271 · Security Note
• https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md · Note