CVE-2026-2860 Details
Description
A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing improper authorization has been identified in the production_ssm system, specifically in the feng_ha_ha/megagao ssm-erp version up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The issue resides in an unknown function of the EmployeeController.java file, where access controls are not properly enforced. This vulnerability affects multiple high-risk interfaces, including /employee/list, /material/list, /user/list, and various file and picture upload/delete endpoints. The lack of authorization checks allows for unauthorized access to sensitive information and functionalities, such as employee ID card details.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 21, 2026CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/megagao/production_ssm/issues/36 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/megagao/production_ssm/issues/36#issue-3914626431 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.347100 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.347100 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.754494 | [email protected] | ExploitIssue TrackingTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| feng_ha_ha/megagao ssm-erp | All versions |
CPE
Remediation
| |
| feng_ha_ha/production_ssm | <= 4288d53bd35757b27f2d070057aefb2c07bdd097 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |