CVE-2026-2860 MEDIUM

CVE-2026-2860: feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization

Vendor Feng_Ha_Ha
Product ssm-erp
Weakness CWE-285
Published February 21, 2026
Last update February 24, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

Disclosure timeline

February 21, 2026 CVE published
February 24, 2026 Record updated