CVE-2026-109183: jshERP Authorization Bypass Vulnerability

CVE-2026-109183 Overview

CVE-2026-109183 is an authorization bypass vulnerability in jshERP through version 3.6, an open-source enterprise resource planning (ERP) application. The flaw resides in the POST /depotHead/addDepotHeadAndDetail endpoint, where the server trusts a client-supplied status parameter. Authenticated users can submit a status value of 1 to mark a newly created depot head (bill) as audited. This bypasses the multi-level approval workflow and audit permission checks that normally gate stock movements. The resulting bill influences stock levels and derived report queries without any approver interaction. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Any authenticated jshERP user can forge pre-approved inventory bills, altering stock records and downstream reports without going through the required approval chain.

Affected Products

• jshERP through 3.6
• jshERP-boot DepotHeadController component
• jshERP-boot DepotHeadService component

Discovery Timeline

• 2026-10-12 - CVE-2026-109183 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109183

Vulnerability Analysis

The vulnerability affects jshERP's warehouse bill creation workflow. In normal operation, a depot head record is created with a pending status and must be routed through audit permission checks and multi-level approvers before it affects stock. The addDepotHeadAndDetail endpoint accepts the full request body, including the status field, and forwards it to the service layer without validating whether the caller is authorized to set an audited state. By passing status=1 in the POST body, an authenticated user instructs the backend to persist the record as already approved. Downstream stock calculations and report queries subsequently treat the forged bill as a legitimate approved document.

Root Cause

The root cause is missing server-side authorization on a sensitive state field [CWE-862]. The DepotHeadController and DepotHeadService code paths referenced in the advisory accept the client-controlled status attribute during creation. The application does not enforce that only users holding audit privileges can submit records in an approved state, nor does it reset the status to a pending value on creation.

Attack Vector

Exploitation requires network access to the jshERP web interface and a valid low-privilege user session. The attacker sends a crafted POST request to /depotHead/addDepotHeadAndDetail containing legitimate bill fields alongside status=1. No user interaction is required. A proof-of-concept Python script is published at the GitHub PoC repository, demonstrating both the write primitive and the derived read of stock data.

See the VulnCheck advisory and the vulnerable source in DepotHeadController.java and DepotHeadService.java for technical details.

Detection Methods for CVE-2026-109183

Indicators of Compromise

• POST requests to /depotHead/addDepotHeadAndDetail containing a status=1 parameter originating from accounts that lack audit privileges.
• New depot head records with status=1 persisted without a corresponding entry in the approval workflow or audit log.
• Unexpected stock quantity changes or inventory report deltas not traceable to an approved transaction.

Detection Strategies

• Inspect web server and application access logs for POST bodies to addDepotHeadAndDetail that include an audit-state value and correlate the submitting user against the audit role list.
• Query the depot head database table for records whose creator does not hold approval permissions but whose status reflects an audited state.
• Compare approval workflow records against created bills to identify documents that skipped the multi-level approval chain.

Monitoring Recommendations

• Alert on any API call to /depotHead/addDepotHeadAndDetail where the authenticated principal is not a member of the audit role.
• Monitor stock reports for sudden adjustments and reconcile them against the approval event stream.
• Enable verbose request body logging for ERP write endpoints to retain evidence of parameter tampering.

How to Mitigate CVE-2026-109183

Immediate Actions Required

• Restrict network access to the jshERP management interface so only trusted users can reach /depotHead/addDepotHeadAndDetail.
• Audit existing depot head records for entries created with an approved status by non-audit accounts and reverse unauthorized stock changes.
• Rotate credentials for accounts that may have been used to exploit the issue and review session tokens.

Patch Information

At the time of publication, no vendor-released patched version is listed for jshERP in the NVD entry. Monitor the jshERP GitHub repository and the VulnCheck advisory for an official fix. Operators maintaining their own builds should modify DepotHeadController and DepotHeadService to ignore the client-supplied status field on creation and force the value to a pending state unless the caller holds the audit role.

Workarounds

• Deploy a reverse proxy or web application firewall rule that strips or rejects the status parameter on POST requests to /depotHead/addDepotHeadAndDetail.
• Apply a server-side patch to overwrite incoming status values with the default pending state before calling the service layer.
• Temporarily restrict the bill creation role to trusted internal users while a vendor fix is pending.

# Example WAF rule (ModSecurity) to block status tampering on the vulnerable endpoint
SecRule REQUEST_URI "@streq /depotHead/addDepotHeadAndDetail" \
  "id:1092026,phase:2,deny,status:403,log,\
   msg:'CVE-2026-109183 jshERP approval bypass attempt',\
   chain"
  SecRule ARGS:status "@rx ^(?!0$).+" "t:none"