EUVD-2026-88643
GHSA-fw7v-38f5-7w57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach api-admin org-staff endpoint
-
ExploitSubmit add request with tampered isAdmin/jobId
-
ExecutionAuthorization check fails to reject
-
ImpactAttacker gains elevated staff privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the api-admin backend's OrgStaffServiceImpl.add (organization-staff creation) function in tacomall 1.0.0, and requires the attacker to submit manipulated isAdmin and/or jobId arguments that the authorization logic fails to validate. VulDB marks this PR:N (no authentication), but because CWE-285 is a flawed-authorization (not missing-authentication) weakness on an admin-side API, realistic exploitation more likely requires at least a low-privileged authenticated session - confirm against the PoC. Limiting factors: the affected software is a single niche open-source project with a small deployment base, and impact is rated low across confidentiality, integrity, and availability. |
| Impact | This is a real-but-low-priority issue. The only quantified severity signal is the VulDB-assigned CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with all-Low vulnerable-system impact VC:L/VI:L/VA:L and E:P proof-of-concept). There is NO NVD score, NO EPSS probability, NO CISA KEV listing, and NO SSVC decision data provided, so exploitation-likelihood cannot be quantified - only that a public PoC exists (E:P). The described weakness (CWE-285 improper authorization via manipulating isAdmin/jobId in an org-staff 'add' function) is a mass-assignment/privilege-escalation pattern, which is real but confined to a single niche open-source e-commerce demo project. Note a metric conflict: VulDB rates PR:N (unauthenticated), yet CWE-285 (improper authorization, as opposed to CWE-306 missing authentication) implies an authorization control exists but is flawed, which typically means the attacker already holds some account - verify the actual auth precondition against the PoC before trusting PR:N. Overall the low deployment footprint and low technical impact outweigh the network vector; this is not an emergency. |
| Exploit ScenarioDerived | An attacker sends a crafted request to the api-admin org-staff 'add' endpoint, tampering with the isAdmin and/or jobId parameters to grant themselves elevated staff/admin privileges the application should have rejected. A public exploit write-up is available (github.com/fangtang7), lowering the barrier to reproduction, though impact is limited to low confidentiality/integrity/availability effects within the tacomall instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.
RemediationAI
No vendor-released patch identified at time of analysis - the wildcard CPE and the absence of any fixed version or commit reference in the advisory data mean there is no upstream version to upgrade to yet, so the following compensating controls are the practical path. First, do not expose the api-admin backend to untrusted networks: bind it to an internal interface and require VPN or an authenticating reverse proxy in front of it, which removes the remote attack surface entirely at the cost of losing direct remote administration. Second, since the defect is a missing authorization check rather than a missing authentication check, add a server-side guard (filter, interceptor, or AOP advice) on the staff-creation endpoint that verifies the caller holds a role permitted to grant isAdmin and that the supplied jobId belongs to the caller's own organization/tenant - this is the only control that addresses the root cause and can be applied without upstream changes. Third, stop binding isAdmin and jobId directly from the request payload: accept them only from an allow-listed field set and default isAdmin to false, which breaks the mass-assignment path the PoC relies on; the trade-off is that legitimate administrative staff-creation flows may need an explicit privileged endpoint. Fourth, if immediate network separation is impractical, a WAF rule blocking requests that set isAdmin=true in the staff-creation path provides short-term mitigation, but such rules are signature-brittle and trivially bypassed by parameter casing, JSON-vs-form encoding, or nested payload variants, so treat it as a stopgap only. Given the low maintenance activity implied by a single 1.0.0 release, plan to carry a local patch or fork if the upstream project does not publish a fix, and monitor https://vuldb.com/vuln/411186 for a corrected version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness class is CWE-285 (Improper Authorization), not a memory-safety issue or injection flaw: the server correctly parses the request but fails to verify that the caller is entitled to perform the privileged action it describes. The affected code lives in the api-admin backend component of tacomall 1.0.0, specifically the add operation of OrgStaffServiceImpl, reached through the ApiMaApplication.java entry point; the 'Application' boot class and *ServiceImpl layering are characteristic of a Spring Boot-style Java service, which means the endpoint is exposed over HTTP(S) and governed by whatever role or interceptor checks the project implements. The manipulation of the isAdmin and jobId arguments indicates the request DTO binds these sensitive fields directly from user input, so a caller can self-elevate to an administrative staff role and/or bind a staff record to a job, organization, or tenant they do not own - a classic mass-assignment-style privilege escalation layered on top of insufficient object- and function-level authorization. The CPE cpe:2.3:a:realjerrytang:tacomall:*:*:*:*:*:*:*:* is a wildcard, meaning no fixed release is known to the feed and every published 1.0.0 build should be treated as affected. The competing CVSS vectors are worth noting: VulDB's v4.0 vector sets PR:N (no privileges required), while our assessment uses PR:L on the reasoning that a flawed-authorization bug on an admin-side API is normally only reachable after some level of login - which of the two holds should be confirmed by reading the published PoC's request setup.
Know when Tacomall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable admin API (AV:N/AC:L); CWE-285 implies a flawed authorization control reached by an existing low-privileged account (PR:L, contra vendor PR:N); mass-assignment priv-esc yields limited C:L/I:L, no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB