CVE-2026-102293: realjerrytang tacomall, заобикаляне на вход и права

Описание

Оригинално описание

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Засегнати продукти

• realjerrytang tacomall: 1.0.0

Вид слабост

• CWE-285 Неправилна авторизация
• CWE-266 Неправилно задаване на привилегии

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-102293
• https://nvd.nist.gov/vuln/detail/CVE-2026-102293
• https://vuldb.com/vuln/411186
• https://vuldb.com/vuln/411186/cti
• https://vuldb.com/cve/CVE-2026-102293
• https://vuldb.com/submit/941875
• https://github.com/fangtang7/CVE/blob/main/tacomall/create.md