CVE-2026-26218 | newbee-mall includes pre-seeded administrator accounts in it… | CVSS 9.8 CRITICAL

Description

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.

Metadata

CVE ID: CVE-2026-26218
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-02-11 20:08 UTC
Published: 2026-02-12 18:38 UTC
Last updated: 2026-07-14 15:54 UTC
Primary CWE: CWE-798
CWE-798 Use of Hard-coded Credentials
Vendor / Product: newbee-ltd / newbee-mall
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
newbee-ltd	newbee-mall	—	1.0.0

Weakness (CWE)

CWE	Source	Description
CWE-798	cna	CWE-798 Use of Hard-coded Credentials

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)