CVE-2026-31271

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality

Critical · published April 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00664 · 51.1th percentile
Published
2026-04-07T00:00Z
EPSS history
Timeline
  • 07 APR 00:00Z
    megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality
    cvelistv5