CVE-2026-22788: wem-project wem

csirt@kutim:~/threat-intel/cve/CVE-2026-22788

CVSS 8.2 · High EPSS 0,59%

Kerentanan Missing Authentication for Critical Function pada wem-project wem. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.

Rincian

Terbit di NVD: 12 Januari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
wem-project	wem	Semua versi sebelum 1.19

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-pp68-5pc2-hv7w exploit · patch · advisory vendor
https://github.com/SMEWebify/WebErpMesv2/commit/3a7ab1c95d1d1c8f7c62c84bc87b3666ecd2fa23 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.