CVE-2026-31271 | megagao production_ssm v1.0 contains an authorization bypass… | CVSS 9.8 CRITICAL

Description

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

Metadata

CVE ID: CVE-2026-31271
State: PUBLISHED
Assigner: mitre
Reserved: 2026-03-09 00:00 UTC
Published: 2026-04-07 00:00 UTC
Last updated: 2026-04-09 14:01 UTC
Primary CWE: CWE-288
CWE-288 Authentication Bypass Using an Alternate Path or Cha…
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-288	adp	CWE-288 Authentication Bypass Using an Alternate Path or Channel

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md