PatchTheCVECVE-2026-26218: newbee-mall includes pre-seeded administrator accounts in its database initialization script
CVE-2026-26218 is a critical-severity flaw (CVSS 9.8) affecting newbee-mall. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 63%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2026-02-12 |
| Last modified | 2026-07-14 |
Last updated 2026-07-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-26218?
newbee-mall: upgrade to newer than 1.0.0. Exact commands for each OS are on this page.
Is CVE-2026-26218 being exploited?
CVE-2026-26218 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-26218 affect?
CVE-2026-26218 affects newbee-mall. Severity is critical (CVSS 9.8). newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema an
How urgent is CVE-2026-26218?
Priority 53/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-10423 LOW 3.7 DOWNGRADE A vulnerability was found in newbee-mall 1.0
- CVE-2025-10422 MEDIUM 4.3 UPGRADE A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7
- CVE-2026-26219 CRITICAL 9.1 UPGRADE newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm
- CVE-2025-1114 LOW 3.5 DOWNGRADE A vulnerability classified as problematic has been found in newbee-mall 1.0
- CVE-2024-48178 HIGH 8.1 DOWNGRADE newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.