Vulnerability · Published Sep 29, 2026 · Assigned by VulDB

CVE-2026-102293realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization

High 7.3

In plain English

A high-severity security flaw in tacomall from realjerrytang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Affected products (as reported)

Vendor	Product	Versions
realjerrytang	tacomall	1.0.0

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-411186 | realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization vdb-entry, technical-description
VDB-411186 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-102293 | CVE Analysis and Report third-party-advisory
Submit #941875 | https://github.com/realjerrytang/tacomall tacomall v1.0.0 Unauthorized access to add administrator user third-party-advisory
https://github.com/fangtang7/CVE/blob/main/tacomall/create.md exploit