CVE-2026-109181

The jshERP software, versions through 3.6 , is affected by an authorization bypass vulnerability. An authenticated user restricted to personal or department data can access other users' bills by including a purchaseStatus=0 value in the search JSON on the GET /depotHead/list endpoint. This input ...