CVE-2026-110114

6.5Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-306

Impact

Unauthenticated remote attackers can purge and rebuild product search indexes across all tenants, degrading search availability. They only need network access to the skyer-goods HTTP service.

Root cause

The es-test maintenance endpoints in GoodsSkuController and SpuController lack authentication checks, directly exposing index deletion and reload routines to the public.

Affected systems

FJ-OMS oms-erp through version PRE

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

No fixed release is documented. Block external and unauthenticated traffic to the /v1/goods/sku/es-test and related es-test endpoints at your reverse proxy or API gateway.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110114