CVE-2026-102293CWE-266CWE-285

CVE-2026-102293

High · published September 29, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-09-29T10:16Z
References (5)
https://github.com/fangtang7/CVE/blob/main/tacomall/create.md · [email protected]https://vuldb.com/cve/CVE-2026-102293 · [email protected]https://vuldb.com/submit/941875 · [email protected]https://vuldb.com/vuln/411186 · [email protected]https://vuldb.com/vuln/411186/cti · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 29 SEP 05:15Z
    realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
    cvelistv5