CVE-2026-109180: jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with access to the affected jshERP tenant can exploit it. The attacker does not need to be assigned to the warehouse whose data they request.
Is every deployment affected by the described bypass?
The bypass applies when the depot_flag warehouse restriction is enabled. In that configuration, user-controlled depotId or depotIds parameters can be used to request arbitrary warehouse IDs.
What information could be exposed?
An attacker may read warehouse stock levels, batch numbers, sales figures, and priced bill-line data. The exposure is limited to data within the tenant.
How can administrators assess possible exposure?
Review requests to affected warehouse-related endpoints, including /depotItem/getMaterialDepotStockByParam, for depotId or depotIds values identifying warehouses not assigned to the requesting user. Such requests may indicate attempts to access unauthorized warehouse data.