Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109181jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

Medium 4.3

In plain English

A medium-severity incorrect authorization in jshERP from jishenghua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

Affected products (as reported)

Vendor	Product	Versions
jishenghua	jshERP	0 – through 3.6

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (3.6) technical-description
Vulnerable Code (3.6) technical-description
VulnCheck Advisory: jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list third-party-advisory