Tacomall
Monthly
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.