vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-2860

feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization

MEDIUM
6.3
CVSS Score
Published: February 21, 2026 at 04:32 AM UTC
Updated: June 17, 2026 at 10:31 AM UTC
4 products affected across 2 vendorsProduction SsmProduction SsmSsm ERP

Using ssm-erp by feng_ha_ha?

Get instant alerts when new vulnerabilities affect ssm-erp - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.3
Exploit prediction
EPSS 0.3%
SSVC
PoC

Description

A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Production Ssm· Feng Ha Ha
60%
4288d53bd35757b27f2d070057aefb2c07bdd097
Ssm ERP· Feng Ha Ha
60%
4288d53bd35757b27f2d070057aefb2c07bdd097
Production Ssm· Megagao
60%
4288d53bd35757b27f2d070057aefb2c07bdd097
Ssm ERP· Megagao
60%
4288d53bd35757b27f2d070057aefb2c07bdd097

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

VDB Entry
Source: cverecord
https://vuldb.com/?id.347100
SignaturePermissions Required
Source: cverecord
https://vuldb.com/?ctiid.347100
Third Party Advisory
Source: cverecord
https://vuldb.com/?submit.754494
Issue Tracking
Source: cverecord
https://github.com/megagao/production_ssm/issues/36
ExploitIssue Tracking
Source: cverecord
https://github.com/megagao/production_ssm/issues/36#issue-3914626431

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.3MEDIUMVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-285CWE-266

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card