CVE-2026-109188: jshERP Authorization Bypass Vulnerability

CVE-2026-109188 Overview

CVE-2026-109188 is a missing authorization vulnerability in jshERP through version 3.6, an open-source enterprise resource planning platform. The flaw exists in multiple master data add and import endpoints that do not enforce role or privilege checks. Any low-privilege authenticated tenant user can issue POST requests to endpoints such as /account/add, /material/add, or /material/importExcel and create tenant-wide master data. This includes settlement accounts, products with initial stock, departments, personnel records, and dictionary entries. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated users with the lowest privilege level can inject fraudulent accounts, products, and organizational records across the tenant, undermining data integrity in financial and inventory workflows.

Affected Products

jshERP through version 3.6
jshERP-boot backend controllers (AccountController, MaterialController, OrganizationController, PersonController, UnitController, and related master data controllers)
Deployments exposing the jshERP REST API to authenticated low-privilege tenants

Discovery Timeline

2026-10-12 - CVE-2026-109188 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109188

Vulnerability Analysis

jshERP exposes a set of Spring-based REST controllers for managing master data. The affected endpoints accept POST requests from any authenticated session but omit the role or permission check that other administrative endpoints enforce. The vulnerability class is Broken Access Control through missing authorization, mapped to CWE-862.

An attacker holding any valid tenant login can call endpoints including /account/add, /material/add, /material/importExcel, /organization/add, /person/add, /unit/add, /materialCategory/add, /materialProperty/add, /materialAttribute/add, /inOutItem/add, and dictionary write endpoints. Each call writes directly to the shared tenant data model used by invoicing, inventory, and reporting modules.

The downstream impact is corruption of trusted business records. Attackers can seed fake settlement accounts to disguise payments, inject products with initial stock to distort inventory valuations, create unauthorized departments or personnel entries, and overwrite dictionary codes used by other workflows.

Root Cause

The controllers listed in the VulnCheck advisory rely on session authentication alone. They do not call the role or permission service before persisting data. See for example the AccountController segment and the MaterialController import segment, where the handler proceeds directly to the service layer after reading the request body.

Attack Vector

Exploitation is remote and requires only a low-privilege authenticated session. The attacker sends a standard POST request with a valid session cookie or token to any of the vulnerable endpoints. No user interaction is required and no elevation steps are needed. Public proof-of-concept scripts demonstrate dictionary writes, global configuration enumeration, and master data creation, as published in the AnkesKasty PoC repository.

No verified sanitized exploit code is reproduced here. Refer to the public proof-of-concept scripts linked in the external references for request structure and payload details.

Detection Methods for CVE-2026-109188

Indicators of Compromise

POST requests to /account/add, /material/add, /material/importExcel, /organization/add, /person/add, or /depotHead/add from accounts that do not belong to administrators or master data stewards.
Unexpected new rows in the jsh_account, jsh_material, jsh_organization, jsh_person, or dictionary tables with creation timestamps outside normal business hours.
Spikes in importExcel activity from user agents or source IPs associated with non-administrative accounts.

Detection Strategies

Compare the user ID in jshERP application logs for each master data write against the role or permission assigned to that user, and alert on writes from users without the master data role.
Hash and baseline the set of master data records at known-good states, then diff on a schedule to catch unauthorized additions.
Inspect reverse proxy or load balancer access logs for POST traffic to the endpoints listed in the VulnCheck advisory and correlate with authenticated session identity.

Monitoring Recommendations

Forward jshERP application logs and database audit logs to a centralized analytics platform for correlation of authentication events with master data mutations.
Alert on bulk creation of accounts, materials, or dictionary entries by a single session within a short time window.
Review scheduled finance and inventory reconciliation reports for anomalies in account balances, stock on hand, and organizational hierarchy.

How to Mitigate CVE-2026-109188

Immediate Actions Required

Restrict network access to the jshERP management API so only trusted internal clients can reach the vulnerable endpoints.
Audit all tenant user accounts and remove or disable sessions that are not required for current operations.
Reconcile master data tables against last known good backups and remove unauthorized records.

Patch Information

No vendor patch is referenced in the NVD entry or the VulnCheck advisory at time of writing. Operators should monitor the jshERP repository for updates addressing the missing role checks in the controllers listed in the advisory. Until a fixed release is published, apply the workarounds below.

Workarounds

Add a reverse proxy rule that blocks POST requests to the affected add and importExcel endpoints from any source other than approved administrator subnets.
Introduce a Spring Security or interceptor-based filter that verifies the caller holds the master data role before invoking controllers such as AccountController, MaterialController, OrganizationController, and PersonController.
Enforce multi-factor authentication for all accounts able to reach the jshERP API to raise the cost of credential abuse.

bash

# Example nginx snippet restricting master data writes to an admin subnet
location ~ ^/(account|material|organization|person|unit|materialCategory|materialProperty|materialAttribute|inOutItem)/(add|importExcel)$ {
    allow 10.10.20.0/24;   # admin workstation subnet
    deny all;
    proxy_pass http://jsherp_backend;
}