{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"4.1.0","last_affected":"4.3.1"}],"component":"ec-cube/ec-cube","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7rhv-h82h-vpjh","id":"tcs_01M5KEYCS4Q26078D29EFX7M1J","modified_at":"2026-03-05T21:32:41.191878Z","published_at":"2026-03-05T21:14:57Z","references":["https://osv.dev/vulnerability/GHSA-7rhv-h82h-vpjh","https://github.com/EC-CUBE/ec-cube/security/advisories/GHSA-7rhv-h82h-vpjh","https://github.com/EC-CUBE/ec-cube/commit/094785943bfc3815c29f0cce9dbabb9bcc688474","https://github.com/EC-CUBE/ec-cube"],"severity":{"label":"medium","score":6.7},"sources":[{"source":"osv","source_id":"GHSA-7rhv-h82h-vpjh","url":"https://osv.dev/vulnerability/GHSA-7rhv-h82h-vpjh"}],"summary":"EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface"}