CVE-2026-109180: jshERP Authorization Bypass Vulnerability

CVE-2026-109180 Overview

CVE-2026-109180 is an authorization bypass vulnerability in jshERP through version 3.6. Authenticated tenant users can read data from warehouses they are not assigned to by supplying attacker-chosen depotId or depotIds parameters. When the depot_flag warehouse restriction is enabled, the application fails to validate that the requested warehouse identifiers fall within the user's assigned scope. Affected endpoints such as /depotItem/getMaterialDepotStockByParam return stock levels, batch numbers, sales figures, and priced bill lines across the tenant. The flaw is tracked as CWE-639, authorization bypass through user-controlled key.

Critical Impact
Authenticated low-privilege users can read inventory, pricing, and sales data from any warehouse within the tenant, breaking the warehouse-scoped access control model.

Affected Products

jshERP through version 3.6
DepotController endpoints returning warehouse-derived data
DepotItemController endpoints including /depotItem/getMaterialDepotStockByParam

Discovery Timeline

2026-10-12 - CVE-2026-109180 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109180

Vulnerability Analysis

jshERP implements a warehouse-scoping feature controlled by the depot_flag setting. When enabled, each user should only see data from their assigned depots. The controllers trust client-supplied depotId and depotIds request parameters without cross-checking them against the authenticated user's assigned warehouse list. As a result, any authenticated tenant user can enumerate or guess warehouse identifiers and request data for them. Returned fields include stock quantities, batch numbers, sales totals, and priced bill lines, exposing operational and commercial information across the tenant boundary intended by depot_flag.

Root Cause

The root cause is missing server-side authorization enforcement on warehouse identifiers passed in requests. The controller methods in DepotController and DepotItemController forward user-supplied depot IDs to service and query layers without intersecting them with the caller's permitted depot set in DepotService. This matches the CWE-639 pattern of authorization bypass through a user-controlled key, where identifiers in the request determine data access without a server-side ownership check.

Attack Vector

Exploitation requires only a valid low-privilege tenant account. An attacker sends an authenticated HTTP request to an affected endpoint such as /depotItem/getMaterialDepotStockByParam and includes depotId or depotIds values corresponding to warehouses they are not assigned to. The server returns the requested data. Public proof-of-concept scripts demonstrate both the warehouse read bypass and the derived priced-bill read path. See the VulnCheck Advisory on jshERP, the GitHub PoC for Warehouse Bypass, and the GitHub PoC for Depot Derived Bypass for technical details.

No synthesized exploit code is included here. Refer to the linked GitHub DepotController Code, GitHub DepotItemController Code, and GitHub DepotService Code for the affected source locations.

Detection Methods for CVE-2026-109180

Indicators of Compromise

Authenticated HTTP requests to /depotItem/getMaterialDepotStockByParam or other depot endpoints containing depotId or depotIds values outside the caller's assigned warehouse set.
Unusual enumeration patterns where a single session queries many sequential depotId values in a short time window.
Elevated response sizes or query counts for low-privilege user accounts accessing stock, batch, or pricing data.

Detection Strategies

Correlate application access logs with the user-to-depot assignment table to flag requests referencing warehouse IDs the user is not assigned to.
Add server-side logging around DepotController and DepotItemController methods to capture incoming depotId and depotIds parameters alongside the authenticated user identity.
Alert on bulk reads of priced bill lines or sales totals by accounts that do not have a business role requiring such access.

Monitoring Recommendations

Baseline normal per-user depot access volume and alert on deviations.
Monitor web application firewall (WAF) and reverse-proxy logs for repeated requests to depot endpoints with varying ID parameters.
Review audit trails after upgrading to identify prior unauthorized access that may have occurred before patching.

How to Mitigate CVE-2026-109180

Immediate Actions Required

Restrict network exposure of jshERP instances to trusted users and networks until a fixed build is deployed.
Review and tighten tenant user accounts, removing unused low-privilege accounts that could be abused for cross-warehouse reads.
Audit recent access logs for requests containing depotId or depotIds parameters against the user-to-depot mapping.

Patch Information

At the time of publication, no vendor-released fixed version is referenced in the NVD entry. Monitor the jshERP repository and the VulnCheck Advisory on jshERP for updates. The fix must enforce server-side intersection of request-supplied depot IDs with the authenticated user's assigned depots in DepotService before any data lookup.

Workarounds

Apply a reverse-proxy or WAF rule that blocks requests to depot endpoints when depotId or depotIds parameters are not expected for the requesting user role.
Disable or restrict the depot_flag warehouse separation feature if it cannot be relied upon to enforce isolation, and compensate with alternative access controls.
Limit affected endpoints such as /depotItem/getMaterialDepotStockByParam to administrative accounts via upstream authorization until a patch is applied.

bash

# Example reverse-proxy rule concept (adapt syntax to your proxy)
# Deny depot endpoint access unless the request originates from an authorized admin role
location /depotItem/getMaterialDepotStockByParam {
    if ($http_x_user_role != "admin") { return 403; }
    proxy_pass http://jsherp_backend;
}