CVE-2026-111691
Received Received - Intake

Authentication Bypass in WIMOOR via X-USERINFO Header Forgery

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111691
EUVD
EUVD-2026-102982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wimoor-erp wimoor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WIMOOR has an authentication bypass flaw where attackers can impersonate any tenant or privilege level by sending an unsigned X-USERINFO header. This allows direct backend access to forge company IDs and user types, enabling unauthorized reading and modification of other tenants' orders, financial data, and Amazon seller authorizations.

Detection Guidance

Detect this vulnerability by monitoring for unsigned X-USERINFO headers in HTTP requests to backend services. Check for requests bypassing the gateway and directly accessing backend ports. Inspect logs for forged companyid and usertype values in headers.

Impact Analysis

Attackers could access and manipulate your orders, financial data, and Amazon seller permissions. This could lead to financial loss, data breaches, or unauthorized changes to your business operations if the system is exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately enforce strict validation of the X-USERINFO header on all backend services. Ensure all requests pass through the gateway and disable direct backend port access. Update WIMOOR to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart