CVE-2026-109181: jshERP Authorization Bypass Vulnerability

CVE-2026-109181 Overview

CVE-2026-109181 is an authorization bypass vulnerability in jshERP through version 3.6. The flaw lets authenticated users whose data access is restricted to personal or departmental scope enumerate bills belonging to other users across the tenant. By injecting a purchaseStatus value into the search JSON on GET /depotHead/list, an attacker causes the DepotHeadService.select method to drop its creator filter. The result is unrestricted read access to purchase, sales, and inventory bills belonging to any user in the tenant. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact

Any low-privilege authenticated user can bypass row-level access control and read all tenant purchase, sales, and inventory bills by adding purchaseStatus=0 to a list query.

Affected Products

• jshERP versions up to and including 3.6
• jshERP-boot backend component containing DepotHeadController and DepotHeadService
• Multi-tenant deployments relying on creator-based or department-based data scoping

Discovery Timeline

• 2026-10-12 - CVE-2026-109181 published to NVD
• 2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-109181

Vulnerability Analysis

The vulnerability resides in the DepotHeadController.list endpoint and the downstream DepotHeadService.select method in jshERP-boot. The service applies a creator-based filter to restrict query results to records owned by the requesting user or their department. That filter is only applied when certain fields in the inbound search JSON are absent. When the request contains a purchaseStatus parameter, the service branches into a code path that omits the creator restriction entirely.

Because the controller trusts client-supplied search criteria, any authenticated user can trigger the alternate path. The query then returns every matching row across the tenant, including bills created by other users and departments. The exposed records contain purchase, sales, and inventory documents that are typically restricted business data.

Root Cause

The root cause is a conditional authorization check in DepotHeadService.select that treats the presence of purchaseStatus as an administrative or trusted query mode. The access-control decision is coupled to a user-controllable query field rather than to the caller's role or data scope. This is a classic broken access control pattern where filter enforcement is optional and bypassable through parameter manipulation.

Attack Vector

Exploitation requires only an authenticated session with the lowest level of access. The attacker issues an HTTP GET request to /depotHead/list with a search JSON payload that includes purchaseStatus=0 (or any value accepted by the branch). The server returns bills owned by other users and departments without further checks.

The vulnerability manifests through a single HTTP parameter manipulation. See the VulnCheck advisory on jshERP and the public proof-of-concept script for request structure and reproduction steps. The vulnerable code paths are documented in the DepotHeadController source and the DepotHeadService source.

Detection Methods for CVE-2026-109181

Indicators of Compromise

• HTTP GET requests to /depotHead/list where the search query parameter contains purchaseStatus originating from non-administrative accounts.
• Response payloads from /depotHead/list containing bill records whose creator field does not match the authenticated session user.
• Unusually large result sets returned from /depotHead/list to accounts that are scoped to personal or department data.

Detection Strategies

• Instrument the DepotHeadController endpoint to log the full inbound search JSON along with the authenticated principal and role.
• Compare the creator field of returned records against the session user and alert when mismatches occur for scoped users.
• Correlate repeated enumeration requests against /depotHead/list with varying purchaseStatus values from a single session.

Monitoring Recommendations

• Ingest jshERP application and web server access logs into a centralized analytics platform for query inspection.
• Baseline the normal distribution of /depotHead/list request volumes per user role and alert on deviations.
• Monitor outbound data volumes from the jshERP application tier for patterns consistent with bulk record extraction.

How to Mitigate CVE-2026-109181

Immediate Actions Required

• Restrict network access to the jshERP /depotHead/list endpoint to trusted internal networks until a fix is applied.
• Audit application logs for prior requests to /depotHead/list that included purchaseStatus from non-administrative accounts.
• Review tenant bill records for unexpected access patterns and notify affected tenants if cross-tenant disclosure is suspected.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the jshERP GitHub repository and the VulnCheck advisory for an official fix. Operators maintaining their own fork should modify DepotHeadService.select so that the creator and department scope filter is applied unconditionally for non-administrative users, regardless of the presence of purchaseStatus.

Workarounds

• Deploy a web application firewall rule that strips or rejects purchaseStatus parameters in search payloads sent to /depotHead/list by non-administrative users.
• Implement a reverse-proxy filter that enforces role-based parameter allow-lists for the jshERP list endpoints.
• Temporarily disable the /depotHead/list endpoint for user roles that do not require cross-record reporting.

# Example NGINX rule to block purchaseStatus in depotHead list queries
location /depotHead/list {
    if ($arg_search ~* "purchaseStatus") {
        return 403;
    }
    proxy_pass http://jsherp_backend;
}