Is CVE-2026-109181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109181 being exploited in the wild.

How severe is CVE-2026-109181?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

Is there a fix for CVE-2026-109181?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109181 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109181?

Check whether you run jshERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109181: jshERP authorization bypass in depot management

CVE-2026-109181 · Severity: medium · CVSS 4.3 · Published 2026-10-12

jshERP is an enterprise resource planning (ERP) system that manages inventory, purchasing, and sales operations. An authorization bypass vulnerability allows authenticated users to view all of their organization's purchase, sales, and inventory records regardless of their assigned data access restrictions by manipulating search parameters. Attackers with basic user accounts can expose sensitive financial and operational data that should be restricted to specific roles or departments.

Technologies: jshERP.

Quick answers

Is CVE-2026-109181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109181 being exploited in the wild.
How severe is CVE-2026-109181?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: jshERP through 3.6.
Is there a fix for CVE-2026-109181?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109181 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109181?: Check whether you run jshERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the GET /depotHead/list endpoint where DepotHeadService.select improperly handles the purchaseStatus parameter. When an attacker includes purchaseStatus=0 in the JSON search request, the service drops its creator/department filter, exposing all tenant records. The flaw affects authenticated users with network access to the application and requires no additional user interaction or authentication bypass.

Affected products

jshERP through 3.6

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.