# CVE-2026-109181: jshERP authorization bypass in depot management

Source: https://junglewise.ai/threats/cve-2026-109181-jsherp-through-3-6-contains-an-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109181 · Severity: medium · CVSS 4.3 · Published 2026-10-12

jshERP is an enterprise resource planning (ERP) system that manages inventory, purchasing, and sales operations. An authorization bypass vulnerability allows authenticated users to view all of their organization's purchase, sales, and inventory records regardless of their assigned data access restrictions by manipulating search parameters. Attackers with basic user accounts can expose sensitive financial and operational data that should be restricted to specific roles or departments.

Technologies: [jshERP](https://junglewise.ai/threats/technologies/x-jsherp).

## Quick answers

**Is CVE-2026-109181 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109181 being exploited in the wild.

**How severe is CVE-2026-109181?** Medium severity, with a CVSS score of 4.3, published 12 October 2026.

**Which products and versions are affected?** jshERP through 3.6.

**Is there a fix for CVE-2026-109181?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109181 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109181?** Check whether you run jshERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the GET /depotHead/list endpoint where DepotHeadService.select improperly handles the purchaseStatus parameter. When an attacker includes purchaseStatus=0 in the JSON search request, the service drops its creator/department filter, exposing all tenant records. The flaw affects authenticated users with network access to the application and requires no additional user interaction or authentication bypass.

## Affected products

- jshERP through 3.6

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_depot_derived_read_scope_bypass.py](https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_depot_derived_read_scope_bypass.py)
- [https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/DepotHeadController.java](https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/DepotHeadController.java)

## Related threats

- [jshERP missing authorization in user status batch update](https://junglewise.ai/threats/cve-2026-110615-jsherp-through-3-6-contains-a-missing-authorization)
- [jshERP missing authorization in master data endpoints](https://junglewise.ai/threats/cve-2026-109188-jsherp-through-3-6-contains-a-missing-authorization)
- [jshERP information disclosure in platform configuration](https://junglewise.ai/threats/cve-2026-109187-jsherp-through-3-6-contains-an-information-disclosure)
- [jshERP authorization bypass in UserController updateUser](https://junglewise.ai/threats/cve-2026-109185-jsherp-through-3-6-contains-a-missing-authorization)