CVE-2026-110114: Missing Authentication for Critical Function in FJ-OMS oms-erp
Description
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
CVSS v4.0
Score 6.9medium
Affected software
FJ-OMS
oms-erp
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in FJ-OMS oms-erp through PRE involves missing authentication on critical maintenance endpoints in the skyer-goods component. Unauthenticated attackers can invoke the /v1/goods/sku/es-test endpoint to delete and rebuild the product search index goods_sku_index_01 across all tenants. This can be exploited repeatedly to degrade search availability by forcing full-table reloads of the index.
Potential Impact
The vulnerability allows unauthenticated attackers to disrupt search functionality by deleting and rebuilding the shared goods_sku_index_01 index for all tenants. This can degrade the availability of product search services, potentially impacting all users relying on this index.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints or implement authentication controls to prevent unauthorized access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-13T16:23:06.462Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace64962cdf04f6568af123
Added to database: 10/13/2026, 17:04:22 UTC
Last enriched: 10/13/2026, 17:19:52 UTC
Last updated: 10/13/2026, 21:57:03 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.