Description
A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| realjerrytang | tacomall | 1.0.0 | — |
References
- VDB-411186 | realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization vdb-entry technical-description
- VDB-411186 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-102293 | CVE Analysis and Report third-party-advisory
- Submit #941875 | https://github.com/realjerrytang/tacomall tacomall v1.0.0 Unauthorized access to add administrator user third-party-advisory
- https://github.com/fangtang7/CVE/blob/main/tacomall/create.md exploit