PT-2026-7887 · Unknown · Newbee-Mall

Lennon Chia · Published 2026-02-12 · Updated 2026-02-25 · CVE-2026-26218

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions newbee-mall (affected versions not specified)

Description The application includes pre-seeded administrator accounts in its database initialization script, which are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change these default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application. The application’s database contains default admin accounts with predictable passwords.

Recommendations Change the default administrative credentials to prevent unauthorized access.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-26218

Affected Products

Newbee-Mall

References · 9

• https://github.com/newbee-ltd/newbee-mall/issues/119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26218 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26218 · Vendor Advisory
• https://vulncheck.com/advisories/newbee-mall-default-seeded-administrator-credentials-allow-account-takeover · Note
• https://twitter.com/CVEnew/status/2022037607375335786 · Twitter Post
• https://twitter.com/CveFindCom/status/2022055980595331095 · Twitter Post
• https://t.me/cveNotify/153181 · Telegram Post
• https://t.me/CVEtracker/44559 · Telegram Post
• https://twitter.com/0dayPublishing/status/2023156551402312119 · Twitter Post