CVE-2026-22788

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-22788

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22788.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-22788

Aliases

GHSA-pp68-5pc2-hv7w

Published

2026-01-12T21:40:11.913Z

Modified

2026-03-14T12:47:50.952450Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

WebErpMesv2 allows unauthenticated API Access

Details

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.

Database specific

{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22788.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/smewebify/weberpmesv2

Affected ranges

Type: GIT
Repo: https://github.com/smewebify/weberpmesv2
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a072c864268f4fa20a670722e265471f39522268

Affected versions

1.*

1.10

v1.*

v1.0-beta

v1.0.0-RC

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.05

v1.06

v1.07

v1.08

v1.09

v1.11

v1.12

v1.13

v1.14

v1.15

v1.16

v1.17

v1.18

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22788.json"