CVE-2026-26218
Default Credential Vulnerability in newbee-mall Administrator Accounts
Publication date: 2026-02-12
Last updated on: 2026-02-25
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| newbee-mall_project | newbee-mall | to 1.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26218 is a critical vulnerability in newbee-mall versions up to 1.0.0 caused by default administrator accounts included in the database initialization script.
These accounts have predictable, hard-coded passwords. If the database is initialized or reset using the provided schema and the default credentials are not changed, unauthenticated attackers can log in as administrators.
This allows attackers to gain full administrative control of the application without needing any privileges or user interaction.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated remote attackers to log in as administrators, resulting in full administrative control over the application.
- Complete compromise of confidentiality, integrity, and availability of the application.
- Attackers can manipulate data, disrupt services, and access sensitive information.
- No user interaction or prior privileges are required to exploit this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the default seeded administrator accounts with predictable passwords are present in the database initialization script or active in the system.
You can attempt to log in using the known default administrator credentials to verify if the vulnerability exists.
Commands to detect this might include querying the database for default administrator accounts or attempting authentication with default passwords.
- Run a database query to list administrator accounts and check for default usernames.
- Attempt login via the application interface using default credentials.
What immediate steps should I take to mitigate this vulnerability?
Immediately change the default seeded administrator passwords to strong, unique passwords.
Avoid using the default database initialization script without modification.
If the database has been initialized or reset using the default schema, reset the administrator passwords immediately.
Implement access controls and monitor for unauthorized login attempts.