CVE-2026-109181: jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this bypass?
Authenticated users whose access is restricted to their own personal data or department data are affected. They can bypass that intended scope and list bills belonging to other users in the same tenant.
What does an attacker need to do to exploit it?
The attacker needs a valid authenticated account and access to GET /depotHead/list. They can add purchaseStatus=0 to the search JSON, which causes the creator filter to be removed.
What data can be exposed?
The bypass can expose tenant-wide purchase, sales, and inventory bills. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.