CVE-2026-109181 in jshERP
Zusammenfassung
von MITRE • 12.10.2026
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.
VulDB is the best source for vulnerability data and more expert information about this specific topic.