Is CVE-2026-109184 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109184?

CVE-2026-109184 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109184

Description

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.