# CVE-2026-11458: erzhongxmu JeeWMS information disclosure in Boot Actuator Endpoint

Source: https://junglewise.ai/threats/cve-2026-11458-erzhongxmu-jeewms-information-disclosure-in-boot-actuator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-11458 · Severity: medium · CVSS 5.3 · Published 2026-06-07

JeeWMS, a warehouse management system, contains a security flaw where sensitive internal diagnostic tools are accessible to anyone on the internet without a password. An attacker can use these tools to download the system's memory or view configuration details, which often contain passwords, secret keys, and customer data. This information could be used to take over the system or gain unauthorized access to the company's private database.

Technologies: [Erzhongxmu JeeWMS](https://junglewise.ai/threats/technologies/jeewms). Vendors: [Erzhongxmu](https://junglewise.ai/threats/vendors/erzhongxmu).

## Quick answers

**Is CVE-2026-11458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11458 being exploited in the wild.

**How severe is CVE-2026-11458?** Medium severity, with a CVSS score of 5.3, published 7 June 2026.

**Which products and versions are affected?** Erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69.

**Is there a fix for CVE-2026-11458?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11458 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11458?** Check whether you run Erzhongxmu JeeWMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

JeeWMS (up to commit 141740a) suffers from improper access control in its ShiroConfig, which explicitly allows anonymous access to the '/base-boot/actuator/**' path. This exposes sensitive Spring Boot Actuator endpoints, specifically '/env' and '/heapdump', to unauthenticated remote attackers. An attacker can exploit this to retrieve environment variables, database credentials, and full JVM heap dumps. Analysis of these dumps can reveal in-memory secrets such as JWTs, session tokens, and API keys, potentially leading to full system compromise. As of the advisory date, the vendor has not responded to disclosure attempts.

## Affected products

- erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69

## Timeline

- 2026-05-13: disclosed: Issue reported on GitHub by researcher
- 2026-06-07: advisory: NVD/VulDB publication date

## References

- [https://github.com/0d000721999/evc1/issues/2](https://github.com/0d000721999/evc1/issues/2)
- [https://vuldb.com/cve/CVE-2026-11458](https://vuldb.com/cve/CVE-2026-11458)
- [https://vuldb.com/submit/828538](https://vuldb.com/submit/828538)
- [https://vuldb.com/vuln/369077](https://vuldb.com/vuln/369077)
- [https://vuldb.com/vuln/369077/cti](https://vuldb.com/vuln/369077/cti)

## Related threats

- [erzhongxmu JEEWMS SQL injection in autocomplete handler](https://junglewise.ai/threats/cve-2026-108782-a-weakness-has-been-identified-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in PDA interface](https://junglewise.ai/threats/cve-2026-108781-a-security-flaw-has-been-discovered-in-erzhongxmu-jeewms-up-to)
- [erzhongxmu JEEWMS SQL injection in WmSttInGoodsController](https://junglewise.ai/threats/cve-2026-108779-a-vulnerability-was-identified-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in inbound quality check](https://junglewise.ai/threats/cve-2026-108778-a-vulnerability-was-determined-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in WvGiController](https://junglewise.ai/threats/cve-2026-108777-a-vulnerability-was-found-in-erzhongxmu-jeewms-up-to-2026-09-27)