Unauthenticated Arbitrary Module Uninstallation in MajorDoMo by Chocapikk

CVE-2026-27181

What is CVE-2026-27181?

The MajorDoMo application is vulnerable to an unauthenticated arbitrary module uninstallation through its market module. The vulnerability stems from the market module's admin() method, which assigns user input to a mode variable directly from the $_REQUEST array. This allows an attacker to exploit the /objects/?module=market endpoint to access all mode-gated functionalities without needing authentication. By sending a series of unauthenticated GET requests, an attacker can execute the uninstallPlugin() function, which subsequently deletes critical module records, executes uninstall scripts, and removes related files from the server. This vulnerability poses a significant risk as it enables the complete removal of a MajorDoMo installation, leading to extensive data loss and service disruption.

References