What is CVE-2026-22788?

CVE-2026-22788 is a high-severity vulnerability in Smewebify Weberpmesv2, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-01-12.

How severe is CVE-2026-22788?

High severity. CVSS v3 base score is 8.2 out of 10.

Auth bypass in Smewebify Weberpmesv2

CVE-2026-22788

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.

Vulnerability class: Broken Authentication

EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Smewebify Weberpmesv2 — versions < 1.19
Wem-project Wem

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-22788?: CVE-2026-22788 is a high-severity vulnerability in Smewebify Weberpmesv2, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-01-12.
How severe is CVE-2026-22788?: High severity. CVSS v3 base score is 8.2 out of 10.