CVE-2026-109180 in jshERP
Zusammenfassung
von MITRE • 12.10.2026
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.