CVE-2026-109182
Deferred Deferred - Pending Action

Incorrect Authorization in jshERP Allows Unauthorized Data Export

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109182
EUVD
EUVD-2026-97386

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jishenghua jshERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has an authorization flaw in the GET /supplier/exportExcel endpoint. Authenticated users can bypass role-based data restrictions applied in /supplier/list. This allows users with limited data access (personal or department scope) to export all supplier, customer, and member records, exposing sensitive information like contacts, phone numbers, tax numbers, bank accounts, and balances.

Detection Guidance

To detect this vulnerability, check for unauthorized access to the /supplier/exportExcel endpoint by authenticated users with restricted roles. Monitor logs for unusual export activities or requests bypassing /supplier/list restrictions. No specific commands are provided in the context.

Impact Analysis

If you use jshERP version 3.6 or earlier, an attacker with valid but restricted credentials could access and export all supplier, customer, and member data. This could lead to data breaches, financial fraud, identity theft, or compliance violations due to unauthorized data exposure.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access and export of personal data. For HIPAA, if the exported data includes protected health information, it would also be a violation. Organizations could face fines, legal penalties, and reputational damage for failing to protect sensitive data.

Mitigation Strategies

Immediately restrict access to the /supplier/exportExcel endpoint to authorized roles only. Ensure role-based data scope restrictions are enforced consistently across all endpoints. Update jshERP to the latest version if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart