CVE-2026-109182: jshERP Authorization Bypass Vulnerability

CVE-2026-109182 Overview

CVE-2026-109182 is an incorrect authorization vulnerability [CWE-863] in jshERP through version 3.6. The flaw resides in the GET /supplier/exportExcel endpoint, which fails to enforce the role-based data scope restrictions applied by the /supplier/list endpoint. Authenticated users whose access is limited to personal or departmental data can invoke the export function to retrieve every supplier, customer, and member record in the system. Exposed fields include contacts, phone numbers, tax numbers, bank accounts, and account balances.

Critical Impact

Any authenticated low-privilege user can export the full partner directory, bypassing tenant and department data isolation and exposing financial and personally identifiable information.

Affected Products

• jshERP versions up to and including 3.6
• SupplierController.exportExcel handler in jshERP-boot
• SupplierService partner lookup functions used by the export path

Discovery Timeline

• 2026-10-12 - CVE-2026-109182 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109182

Vulnerability Analysis

jshERP enforces data scope filtering in the /supplier/list endpoint used by the UI. The filter restricts a logged-in user to records tied to their user ID or department, depending on the configured role scope. The parallel /supplier/exportExcel endpoint reuses the underlying SupplierService lookup but omits the scope filter. As a result, the service returns all partner rows regardless of the caller's role boundary. The export path serializes the full result set into an Excel file and returns it to the caller. This mismatch between the list and export code paths defeats the application's authorization model for partner data.

Root Cause

The root cause is inconsistent authorization enforcement across controller methods that query the same underlying data. The export handler in SupplierController calls a service method that does not inject the current user's data scope predicates. Authorization is implicit in the list query but absent from the export query, which is a classic broken access control pattern tracked as [CWE-863].

Attack Vector

Exploitation requires a valid low-privilege session on the jshERP instance. The attacker issues an HTTP GET request to /supplier/exportExcel with filter parameters matching those used by /supplier/list. The server returns an Excel workbook containing every supplier, customer, and member record, including sensitive contact and financial fields. No elevated role, CSRF token manipulation, or payload crafting is required beyond standard authenticated navigation. A public proof-of-concept script is referenced in the VulnCheck Advisory for jshERP and in the GitHub PoC repository.

See the vulnerable handler in the SupplierController source and the backing service in the SupplierService source.

Detection Methods for CVE-2026-109182

Indicators of Compromise

• Unexpected GET /supplier/exportExcel requests from accounts that normally only access their own records.
• Large Excel downloads from the jshERP application correlated with low-privilege session IDs.
• Repeated export requests spanning different filter parameters from a single session within a short window.

Detection Strategies

• Compare the result-set sizes between /supplier/list and /supplier/exportExcel for the same user and alert on significant mismatches.
• Deploy web application firewall rules that log every call to /supplier/exportExcel and tag the caller's role identifier.
• Review application access logs for export calls issued by accounts assigned the personal or department data scope.

Monitoring Recommendations

• Forward jshERP application and reverse-proxy logs to a central analytics pipeline for sustained review.
• Baseline normal export volumes per role and alert on deviations greater than one standard deviation.
• Monitor outbound data transfer sizes from the jshERP host for sudden spikes consistent with bulk partner exports.

How to Mitigate CVE-2026-109182

Immediate Actions Required

• Restrict network access to /supplier/exportExcel to administrative accounts via a reverse proxy or WAF rule.
• Revoke the export permission from any role mapped to personal or department data scope until a patched build is deployed.
• Audit recent export activity to identify accounts that may have exfiltrated partner data.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-109182. Monitor the jshERP repository and the VulnCheck Advisory for jshERP for an official patch. The fix must apply the same data scope predicates used by SupplierService.getSupplierList to the export method, ensuring consistent authorization across both code paths.

Workarounds

• Block /supplier/exportExcel at the ingress proxy for all non-administrator roles.
• Add a servlet filter in front of SupplierController.exportExcel that validates the caller's role against the data scope policy before invoking the service.
• Disable the export feature in the jshERP UI configuration and perform exports only from an administrative workstation.

# Example NGINX snippet to block the vulnerable endpoint for non-admin users
location = /supplier/exportExcel {
    if ($http_x_user_role != "admin") {
        return 403;
    }
    proxy_pass http://jsherp_backend;
}