CVE-2026-109181
Deferred Deferred - Pending Action

Authorization Bypass in jshERP Exposes Bills

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109181
EUVD
EUVD-2026-97385

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jishenghua jshERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has an authorization bypass flaw. Authenticated users restricted to personal or department data can list other users' bills by adding purchaseStatus=0 to the search JSON on GET /depotHead/list. This causes DepotHeadService.select to drop the creator filter, exposing all tenant purchase, sales, and inventory bills.

Detection Guidance

Check if authenticated users can access other users' data by sending a GET request to /depotHead/list with purchaseStatus=0 in the JSON payload. If unauthorized bills are returned, the vulnerability is present.

Impact Analysis

Attackers with authenticated access can view sensitive financial data of other users, including purchases, sales, and inventory records. This could lead to data breaches, financial fraud, or unauthorized access to confidential business information.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive personal or financial data without authorization. Organizations may face legal penalties, reputational damage, and loss of customer trust due to non-compliance with data privacy requirements.

Mitigation Strategies

Update jshERP to the latest version beyond 3.6. If an update is unavailable, restrict access to /depotHead/list endpoints and validate user permissions strictly to prevent unauthorized data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart