CVE-2026-110114
Received Received - Intake

Authentication Bypass in FJ-OMS oms-erp via es-test Endpoint

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110114
EUVD
EUVD-2026-98945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FJ-OMS oms-erp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in FJ-OMS oms-erp. It allows unauthenticated attackers to delete and rebuild product search indexes by exploiting public maintenance endpoints. Specifically, attackers can repeatedly call /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants, forcing full-table reloads and degrading search availability.

Detection Guidance

Check for repeated requests to the endpoint /v1/goods/sku/es-test. Monitor for unauthorized deletion or rebuilding of product search indexes, particularly the goods_sku_index_01 index. Look for degraded search availability across tenants.

Impact Analysis

This vulnerability can lead to denial of service by making product search unavailable. Attackers can repeatedly trigger index rebuilds, causing performance degradation and potential downtime for search functionality. It may also allow unauthorized manipulation of product data if combined with other vulnerabilities.

Mitigation Strategies

Restrict access to the /v1/goods/sku/es-test endpoint. Apply authentication to maintenance endpoints. Update FJ-OMS oms-erp to a version that addresses the missing authentication issue. Monitor logs for suspicious activity targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart