Is CVE-2026-109182 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109182?

CVE-2026-109182 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109182

Description

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.