CVE-2026-109182: jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Any authenticated jshERP user whose role is limited to personal or department data scope may be able to export records outside that scope. The affected export can expose supplier, customer, and member records.
What does an attacker need to exploit the vulnerability?
The attacker needs valid authentication to jshERP. No user interaction is required, and the affected endpoint is reachable over the network.
What data could be disclosed?
An unauthorized export may disclose contact information, phone numbers, tax numbers, bank account details, and balances for all supplier, customer, and member records.
How can I determine whether my deployment is affected?
Deployments running jshERP through version 3.6 are affected according to the provided information. To validate exposure, test whether an authenticated account restricted to personal or department scope can access GET /supplier/exportExcel and receive records beyond its permitted scope.