What is the CVSS score of CVE-2026-31272?

CVE-2026-31272 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-31272?

CVE-2026-31272 affects MRCMS 3.1.2 and allows unauthenticated remote attackers to create super administrator accounts, enabling complete system compromise without credentials.

How to fix or mitigate CVE-2026-31272?

Within 24 hours: Identify all MRCMS 3.1.2 instances in your environment and isolate or disable network access to the UserController endpoint. Within 7 days: Contact MRCMS vendor for patch availability and timeline; implement network segmentation or WAF rules to restrict access to /UserController.save() endpoints to authenticated sessions only. Within 30 days: Upgrade to a patched MRCMS version once available, or migrate to an alternative solution if vendor support is unavailable. Audit all user accounts created within the last 90 days for unauthorized administrative accounts.

Java CVE-2026-31272

EUVD-2026-19767 CRITICAL

Improper Access Control (CWE-284)

2026-04-07 mitre

GHSA-84xj-452r-299m

Authentication Bypass Java

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19767

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication.

AnalysisAI

Unauthenticated super administrator account creation in MRCMS 3.1.2 allows remote attackers to bypass all access controls and add privileged accounts directly via UserController.save() method. The vulnerability exposes full system compromise through network-accessible endpoints requiring no prior authentication. CVSS 9.8 critical severity reflects unrestricted administrative takeover. No public exploit identified at time of analysis; low observed exploitation activity (EPSS <1%).

Technical ContextAI

Missing authorization validation in UserController.save() Java method permits unauthenticated HTTP requests to invoke privileged account creation logic. CWE-284 improper access control stems from absent role/permission checks before persisting user objects with elevated privileges. CVSS vector PR:N confirms no authentication barrier exists at vulnerable endpoint.

RemediationAI

No vendor-released patch identified at time of analysis. Primary mitigation: implement mandatory authentication and role-based authorization checks in UserController.save() method before processing account creation requests. Validate caller privileges against ADMIN role using framework security context. Immediate workaround: disable or restrict network access to affected /user/save endpoint via firewall rules or web application firewall policies until code-level fix deployed. Monitor authentication logs for unauthorized account creation attempts targeting administrative roles. Review existing user accounts for suspicious super administrator entries created without proper approval workflows. Reference vulnerability disclosure: https://github.com/clockw1se0v0/Vul/blob/main/MRCMS/Unauthorized.md and advisory details at https://vuldb.com/vuln/355892.