CVE-2026-109180 jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

CVE-2026-109180

The jshERP software, version through 3.6 , is affected by an authorization bypass vulnerability (CWE-639). Authenticated users can access data from unassigned warehouses by providing arbitrary depotId or depotIds request parameters. Specifically, when the depot_flag warehouse restriction is activ...

CVE-2026-109180 jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

PT-2026-110569

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...