CVE-2026-109183

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated low-privilege users can bypass bill approvals and manipulate stock data directly. They only need network access and valid user credentials to send a crafted POST request to the API.

Root cause

The /depotHead/addDepotHeadAndDetail endpoint directly accepts a client-supplied status parameter without enforcing audit permission checks or multi-level approval workflows.

Affected systems

jshERP through 3.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade to a version beyond 3.6 once available. As an interim mitigation, restrict network access to the API endpoint or use a reverse proxy/WAF rule to strip or block the status field in POST requests to /depotHead/addDepotHeadAndDetail from non-admin roles.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109183