CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...