CVE-2026-109181

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
jishenghua	jshERP	<= 3.6

References

Timeline

Published: Oct 12, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1091824.3jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass CVE-2026-1091834.3jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting st CVE-2026-1091844.3jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement acc CVE-2026-1091858.8jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users t CVE-2026-1091868.8jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrit CVE-2026-1091876.5jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration s CVE-2026-1091884.3jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master CVE-2026-1091896.3A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.test CVE-2026-109198.3Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-1091906.3A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsT CVE-2026-1091914.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Ex CVE-2026-1091937.2The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t