CVE-2026-26218
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
Risk Assessment
The risk for the organization is the potential for complete takeover of the application by an unauthenticated attacker, leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately change the default password for all administrator accounts in newbee-mall and remove or modify the database initialization script to avoid pre-seeded accounts with default passwords.
Original NVD description (English source)
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.