CVE-2026-109180

The jshERP software, version through 3.6 , is affected by an authorization bypass vulnerability (CWE-639). Authenticated users can access data from unassigned warehouses by providing arbitrary depotId or depotIds request parameters. Specifically, when the depot_flag warehouse restriction is activ...