What’s Vulnerable › Vulnerabilities

CVE-2026-30777

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-05 · updated 2026-06-17
• Weakness: CWE-288

Description

EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.

Affected products

• EC-CUBE CO.,LTD. EC-CUBE: from 4.1.0 before 4.1.2; from 4.2.0 before 4.2.3; from 4.3.0 before 4.3.1; 4.1.2, 4.1.2-p1, 4.1.2-p2, 4.1.2-p3, 4.1.2-p4, 4.2.3 (+2) — fixed in 4.1.2, 4.2.3, 4.3.1

How to fix

Upgrade to a fixed version: EC-CUBE CO.,LTD. EC-CUBE 4.1.2, 4.2.3, 4.3.1. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/jp/JVN63765888/
• https://www.ec-cube.net/info/weakness/20260209/index.php

Get alerted when CVE-2026-30777 or the next vulnerability affects your stack