CVE-2026-31272

MRCMS version 3.1.2 contains a critical access control vulnerability in the UserController.java file where the save() method fails to properly validate user authorization. This flaw allows attackers to directly add super administrator accounts to the application without requiring any form of authentication or user interaction. The vulnerability is particularly dangerous because it completely bypasses the application's authentication mechanisms. The vulnerability has been assigned a CVSS score of 9.8 (Critical) with a network-based attack vector requiring low complexity and no privileges or user interaction. Exploitation would result in complete compromise of confidentiality, integrity, and availability across the entire affected system. An attacker can remotely exploit this flaw from the network to gain full administrative control of the application. There is currently no evidence of active exploitation in the wild, with the vulnerability absent from public exploit databases and vulnerability tracking lists. The EPSS probability score of 0.000570000 indicates relatively low likelihood of exploitation compared to other known vulnerabilities. However, organizations running MRCMS 3.1.2 should treat this as a high-priority remediation item given its critical severity rating and the straightforward nature of the attack.