Is CVE-2026-109187 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109187?

CVE-2026-109187 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109187

Description

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.