CVE-2026-102293 PUBLISHED

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

• 3265048908 (VulDB User) reporter

• VDB-411186 | realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
• VDB-411186 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-102293 | CVE Analysis and Report
• Submit #941875 | https://github.com/realjerrytang/tacomall tacomall v1.0.0 Unauthorized access to add administrator user
• https://github.com/fangtang7/CVE/blob/main/tacomall/create.md

• Improper Authorization CWE
• Incorrect Privilege Assignment CWE