Cyber Posture

CVE-2026-31271

Critical

Published: 07 April 2026

Published
07 April 2026
Modified
09 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system…

more

compromise.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces approved authorizations for access to the /user/insert endpoint, directly preventing unauthenticated attackers from creating super administrator accounts.

prevent

Requires identification and authentication of organizational users before allowing access to sensitive functions like user insertion, addressing the missing authentication checks in UserController.java.

prevent

Manages account provisioning and creation processes to ensure only authorized entities can create accounts, mitigating unauthorized super administrator account creation.

Security SummaryAI

CVE-2026-31271 is an authorization bypass vulnerability affecting megagao production_ssm version 1.0. The flaw resides in the user addition functionality, specifically the insert() method within UserController.java, which lacks proper authentication checks. This allows attackers to interact with the vulnerable component without verifying user privileges, as documented under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this vulnerability by directly accessing the /user/insert endpoint. By sending crafted requests to this endpoint, they can create super administrator accounts, granting full control over the system. Successful exploitation leads to complete system compromise, enabling arbitrary administrative actions such as data manipulation, privilege escalation, or further persistence.

The advisory detailing this issue is available at https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md, which documents the unauthorized access mechanism but does not specify patches or mitigations in the provided references. Security practitioners should review the source code for affected deployments and implement access controls on the /user/insert endpoint, such as requiring authentication tokens or IP whitelisting, pending official vendor guidance.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an authorization bypass in a public-facing web application endpoint (/user/insert), allowing unauthenticated attackers to create super administrator accounts, directly enabling T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References