CVE-2026-109180: Authorization Bypass Through User-Controlled Key in jishenghua jshERP
Description
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
CVSS v4.0
Score 5.3medium
Affected software
jishenghua
jshERP
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109180 is an authorization bypass vulnerability in jshERP through version 3.6. Authenticated users can supply arbitrary depotId or depotIds request parameters to bypass warehouse restrictions (depot_flag) and access stock levels, batch numbers, sales figures, and priced bill lines for warehouses they are not authorized to view. This vulnerability affects endpoints like /depotItem/getMaterialDepotStockByParam within the tenant environment.
Potential Impact
The vulnerability allows unauthorized read access to sensitive warehouse data including stock levels, batch numbers, sales figures, and priced bill lines. This could lead to information disclosure within the affected tenant but does not allow modification or other actions. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor access to endpoints that accept depotId or depotIds parameters to detect potential abuse.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T12:57:19.180Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6accde4f2cdf04f65696c0b0
Added to database: 10/12/2026, 13:19:11 UTC
Last enriched: 10/12/2026, 13:33:59 UTC
Last updated: 10/12/2026, 21:47:25 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.