What is CVE-2026-31271?

CVE-2026-31271 is a critical-severity vulnerability in N/a, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2026-04-07.

How severe is CVE-2026-31271?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in N/a

CVE-2026-31271

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

EPSS: 0.006 (43.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

cve@mitre.org

Frequently asked questions

What is CVE-2026-31271?: CVE-2026-31271 is a critical-severity vulnerability in N/a, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2026-04-07.
How severe is CVE-2026-31271?: Critical severity. CVSS v3 base score is 9.8 out of 10.