CVE-2026-22788

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22788
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22788.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22788
Aliases
  • GHSA-pp68-5pc2-hv7w
Published
2026-01-12T21:40:11Z
Modified
2026-08-12T03:51:44Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
WebErpMesv2 allows unauthenticated API Access
Details

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22788.json"
}
References

Affected packages

Git / github.com/smewebify/weberpmesv2

Affected ranges

Type
GIT
Repo
https://github.com/smewebify/weberpmesv2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a072c864268f4fa20a670722e265471f39522268
Fixed
3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:wem-project:wem:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.19"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.10
v1.*
v1.0-beta
v1.0.0-RC
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.05
v1.06
v1.07
v1.08
v1.09
v1.11
v1.12
v1.13
v1.14
v1.15
v1.17
v1.18

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22788.json"