CVE-2026-2860
BaseFortify
Publication date: 2026-02-21
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| feng_ha_ha | production_ssm | to 1.0 (inc) |
| feng_ha_ha | ssm_erp | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2860 is an improper authorization vulnerability found in the EmployeeController.java file of the feng_ha_ha/megagao ssm-erp and production_ssm projects. The vulnerability arises because the system fails to perform proper authorization checks on several critical interfaces, allowing unauthorized users to access and interact with sensitive data and perform file operations without permission.
- Affected interfaces include endpoints such as /employee/list, /material/list, /user/list, /file/upload, /file/download, /file/delete, /pic/upload, and /pic/delete.
- The vulnerability allows remote attackers to bypass authorization controls and access or manipulate sensitive information and resources.
The issue is due to missing or incomplete access control implementations, despite the use of the Shiro security framework, which leaves critical endpoints unprotected.
How can this vulnerability impact me? :
This vulnerability can have significant security impacts by allowing unauthorized users to access sensitive data and perform unauthorized actions on the system.
- Unauthorized access to sensitive employee information, such as user ID card details.
- Ability to upload, download, or delete files and pictures without proper authorization.
- Perform unauthorized operations like adding departments or deleting customers.
Overall, the vulnerability compromises the confidentiality, integrity, and availability of the system, potentially leading to data breaches, data manipulation, and disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing access to several critical endpoints that lack proper authorization controls. Key vulnerable endpoints include: /employee/list, /material/list, /user/list, /file/upload, /file/download, /file/delete, /pic/upload, and /pic/delete.'}, {'type': 'paragraph', 'content': 'You can use HTTP request commands such as curl to check if these endpoints allow unauthorized access. For example, to test unauthorized access to the employee list, you can run:'}, {'type': 'list_item', 'content': 'curl -X GET http://<target-host>/employee/list'}, {'type': 'list_item', 'content': 'curl -X POST http://<target-host>/department/insert -d \'{"departmentName":"test"}\''}, {'type': 'list_item', 'content': 'curl -X POST http://<target-host>/custom/delete_batch -d \'{"ids":[1,2,3]}\''}, {'type': 'paragraph', 'content': 'If these commands succeed without authentication or authorization errors, it indicates the presence of the vulnerability due to improper access control.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Currently, there are no known countermeasures or official patches available for this vulnerability as the project maintainers have not responded to the issue.
Immediate mitigation steps include:
- Restrict network access to the affected endpoints by implementing firewall rules or network segmentation to limit exposure.
- Implement external access control mechanisms such as reverse proxies or API gateways that enforce authentication and authorization.
- Monitor logs and network traffic for suspicious access patterns to these endpoints.
- Consider replacing the vulnerable software with alternative ERP solutions that provide proper access control.