CVE-2026-109182 — jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7