Is CVE-2026-109180 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109180?

CVE-2026-109180 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109180

Description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.