CVE-2026-109181 — jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding …
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7