CVE-2026-26218 newbee-mall Default Seeded Administrator Credentials Allow Account Takeover
Attackers can take over administrator accounts in newbee-mall if default seeded credentials are not changed after database initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26218?
CVE-2026-26218 is a critical vulnerability in newbee-ltd newbee-mall, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
Weakness: CWE-798
Which versions are affected by CVE-2026-26218?
It affects 1 product.
Products include Newbee-Mall Project Newbee-Mall.
How do I fix CVE-2026-26218?
No fix has been published for CVE-2026-26218 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-26218 being exploited?
There is no known exploitation of CVE-2026-26218 in the wild and no public exploit code.
Other vulnerabilities in newbee-ltd newbee-mall
Sources
Also known as GHSA-3qgp-4ccx-9wvf.