CVE-2026-109182CWE-863broken-access-control

CVE-2026-109182

Medium · published October 12, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-12T17:17Z
References (5)
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_supplier_partner_scope_bypass.py · [email protected]https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/SupplierController.java#L488-L501 · [email protected]https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/service/SupplierService.java#L400-L408 · [email protected]https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/service/SupplierService.java#L92-L96 · [email protected]https://www.vulncheck.com/advisories/jsherp-through-3.6-incorrect-authorization-via-supplier-exportexcel · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 13:10Z
    jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
    cvelistv5
  • 12 OCT 13:10Z
    jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
    cvelistv5