ZeroDay Findings
Sign inSign up

Findings

CVE-2026-31271

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality.

Published Apr 7, 2026 · updated Jun 17, 2026

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 7, 2026 · NIST NVD

    Detected

    megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

  2. Jun 17, 2026 · NIST NVD

    Updated

    megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

Sources

  • CVE.orgVulnerability recordCVE-2026-31271

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-31271

    megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing t

    nvd.nist.gov

References