Which versions of newbee-mall are affected by CVE-2026-26218?

newbee-mall contains hard-coded default administrator credentials shipped in its database schema that enable remote unauthenticated attackers to assume full administrative control over deployed…

Is there a public PoC exploit available for CVE-2026-26218?

Yes, a public proof-of-concept exploit is available for CVE-2026-26218. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26218?

Within 24 hours, audit all newbee-mall instances to verify whether they are running with default-seeded administrator credentials by attempting login or reviewing database initialization logs. Within 7 days, immediately change all default administrator credentials to complex, randomly generated passwords and implement network-level access controls restricting administrative interfaces to known internal IP ranges; additionally, regenerate all active session tokens and force re-authentication. Within 30 days, monitor newbee-mall project releases and vendor advisories for a patched version; establish a testing plan to evaluate upgrading once a fix is available, and deploy Web Application Firewall rules to block credential enumeration and unauthorized administrative endpoint access.

newbee-mall CVE-2026-26218

Q: What is the CVSS score of CVE-2026-26218?

CVE-2026-26218 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-02-12 disclosure@vulncheck.com

Authentication Bypass Newbee Mall Newbee Mall Project

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable admin login, no attacker authentication or interaction, and a public default password yield PR:N/AC:L with full C/I/A on the compromised application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 25, 2026 - 16:41 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 19:15 nvd

CRITICAL 9.8

DescriptionCVE.org

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.

AnalysisAI

Administrative account takeover in newbee-mall arises from pre-seeded admin accounts shipped in the database initialization schema with a predictable, publicly known default password. Any deployment that runs the provided schema and leaves the seeded credentials unchanged lets remote unauthenticated attackers log in as administrator and take full control of the storefront and its backend. Publicly available exploit information exists (project issue #119 and a VulnCheck advisory), though EPSS is low (0.13%) and it is not listed in CISA KEV, so no public exploit identified as actively exploited.

Technical ContextAI

newbee-mall is an open-source Java/Spring Boot e-commerce (mall) learning application backed by a relational database. The root cause is CWE-798 (Use of Hard-coded Credentials): the SQL initialization/seed script that bootstraps the database creates one or more administrator rows with a fixed, hard-coded password hash. Because the credential ships in the source repository, its plaintext is effectively public knowledge and identical across every default install, meaning the admin login is not a secret the attacker must recover but a constant they already possess. The single affected CPE is cpe:2.3:a:newbee-mall_project:newbee-mall (all versions, per the wildcard), so the exposure is a property of the project's seed data rather than a specific runtime code path.

RemediationAI

No vendor-released patched version is independently confirmed from the available data, so the primary remediation is operational: immediately change the default administrator password on any existing deployment, and for new deployments modify the initialization SQL so it does not seed a known password (or forces a password reset on first login). Audit the admin account table for the seeded default and remove or disable any unused pre-provisioned admin rows. As compensating controls until credentials are verified rotated, restrict network access to the admin login/panel endpoints to trusted management IPs (trade-off: complicates legitimate remote administration) and place the application behind an authenticating reverse proxy or VPN (trade-off: added operational overhead). Enforce a strong-password policy and, if supported, enable account lockout/MFA on admin logins. Track the upstream issue at https://github.com/newbee-ltd/newbee-mall/issues/119 and the VulnCheck advisory (https://www.vulncheck.com/advisories/newbee-mall-default-seeded-administrator-credentials-allow-account-takeover) for an official fix; do not rely on a patch version number, as none is confirmed here.