ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restriction…

Published Oct 12, 2026 · updated Oct 14, 2026

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

  2. Oct 14, 2026 · NIST NVD

    Updated

    jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.

Sources

  • CVE.orgVulnerability recordCVE-2026-109182

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-109182

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-109182

    jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, cust

    nvd.nist.gov

References