CVE-2026-31272: Mrcms

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication.

Affected products

• Mrcms Mrcms: version 3.1.2 only

Published 2026-04-07. Last modified 2026-06-17.