CVE-2026-109182

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-863

Impact

Authenticated low-privilege users can export every supplier, customer, and member record across the entire system. Attackers need a valid user account to access the export endpoint and bypass personal or department data boundaries.

Root cause

The GET /supplier/exportExcel endpoint fails to enforce role-based data scope filters that are applied to the standard listing endpoint.

Affected systems

jshERP through 3.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

No official fixed release is specified in the advisory; upgrade past 3.6 once a patched release is available. In the interim, restrict or block access to the GET /supplier/exportExcel endpoint at your reverse proxy or API gateway.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109182