An authorization bypass flaw allows an attacker to call the /user/insert endpoint without any authentication. The insert() method in UserController.java lacks checks for the caller’s identity, so any entity can add a user record with super administrator rights. This weakness is categorized as CWE‑288. The ability to create a privileged account grants the attacker full system control, enabling configuration changes, data exfiltration, persistence, and any other actions a super admin can perform.

The flaw exists in megagao production_ssm version 1.0. No vendor or product details beyond that version are supplied.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score of less than 1% indicates that exploitation has not yet been observed widely, and it has not entered the CISA KEV catalog. The likely attack vector is a remote HTTP POST to /user/insert, which can be executed from anywhere that can reach the exposed endpoint, resulting in immediate system compromise.