CVE-2026-109180

The jshERP software, version through 3.6 , is affected by an authorization bypass vulnerability (CWE-639). Authenticated users can access data from unassigned warehouses by providing arbitrary depotId or depotIds request parameters. Specifically, when the depot_flag warehouse restriction is activ...

EUVD-2026-97384

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...