EUVD-2026-97384
GHSA-78f4-72qq-hj94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant user
-
ExploitCall getMaterialDepotStockByParam with arbitrary depotIds
-
ExecutionBypass depot_flag warehouse restriction
-
ImpactRead unassigned-warehouse stock, batch and pricing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account within the target jshERP tenant (PR:L) - no admin rights are needed, only the ability to call warehouse/stock endpoints. The bypass is specifically relevant when the depot_flag warehouse-restriction feature is enabled, which is the control the attacker defeats by passing arbitrary depotId or depotIds parameters to endpoints like /depotItem/getMaterialDepotStockByParam. Limiting factors: exploitation is confined to data within the attacker's own tenant, is read-only (no integrity or availability impact), and provides no value in single-warehouse or single-operator deployments where no cross-warehouse segregation exists. jshERP 3.6 and earlier are affected. |
| Impact | This is a medium-severity information-disclosure (IDOR / CWE-639) issue, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and matches the description: network-reachable, low-complexity, requires an authenticated low-privilege account (PR:L), no user interaction, and only a limited confidentiality impact with zero integrity or availability impact. Publicly available exploit code exists (two POC scripts published by the VulnCheck-associated researcher), which raises practical exploitability for anyone who already holds a valid tenant account. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the POC availability should not be conflated with in-the-wild use. The real-world risk is best characterized as a credentialed, same-tenant data-leak primitive (cross-warehouse stock, batch, sales and pricing data) rather than a remotely-wormable critical flaw. For a multi-tenant or multi-department jshERP deployment where warehouse segregation (depot_flag) is a security control, this is a genuine confidentiality concern; for single-operator deployments the impact is marginal. Net: patch in normal cycle, prioritize only if you rely on warehouse-level access segregation. |
| Exploit ScenarioDerived | A low-privileged but authenticated jshERP user (e.g. a staff account scoped to one warehouse) sends a request to an endpoint such as /depotItem/getMaterialDepotStockByParam, supplying depotId/depotIds values for warehouses they are not assigned to. Because the depot_flag restriction is not enforced on these user-supplied IDs, the server returns stock levels, batch numbers, sales figures and priced bill lines for those arbitrary warehouses within the tenant. Two public POC scripts demonstrating the read-scope bypass are available, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Authenticated users of jshERP through 3.6 can bypass the depot_flag warehouse restriction to read stock levels, batch numbers, sales figures and priced bill lines from warehouses they are not assigned to, by supplying arbitrary depotId or depotIds parameters to endpoints such as /depotItem/getMaterialDepotStockByParam. Only a low-privileged account inside the target tenant is required (CVSS 3.1 PR:L, read-only C:L impact, no integrity or availability effect), and publicly available exploit code exists, though there is no indication of confirmed active exploitation. Exposure is confined to cross-warehouse data segregation within a single tenant, so single-warehouse or single-operator deployments where no segregation is configured gain no practical advantage from the flaw.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must initially be code-level or compensating. Where source access is available, add a server-side authorization filter that resolves depotId/depotIds from the authenticated user's assigned warehouses and rejects or rewrites any client-supplied value outside that set before it reaches DepotService, DepotController or DepotItemController; this is the only fix that restores the depot_flag guarantee and it preserves legitimate multi-warehouse workflows. Until that code fix is deployed, restrict network reachability of the jshERP backend to trusted networks, and place the warehouse/stock read endpoints (notably /depotItem/getMaterialDepotStockByParam and the depot query endpoints around DepotController lines 249-283) behind a role restriction or reverse-proxy/WAF rule that blocks requests carrying depotId or depotIds parameters not belonging to the calling account's assignment; note the trade-off that coarse blocking of these endpoints will break legitimate stock lookups for multi-warehouse users, so it should be scoped by role rather than applied globally. Disabling depot_flag is not an acceptable mitigation because it removes the segregation control entirely rather than enforcing it. Because exploit scripts are publicly available at https://github.com/AnkesKasty/cve-request-poc (poc_depot_derived_read_scope_bypass.py and poc_warehouse_and_price_read_bypass.py), log and alert on enumeration of sequential depotId values by low-privileged accounts, and review existing audit logs for prior cross-warehouse reads. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/jsherp-through-3.6-authorization-bypass-via-user-controlled-warehouse-ids for any updated fix information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-639 authorization bypass through a user-controlled key. jshERP is a Java/Spring Boot ERP that offers an administrative 'depot_flag' mode intended to limit each user to an assigned subset of warehouses; the flaw is that several read paths trust warehouse identifiers taken straight from the HTTP request instead of deriving the permitted set from the authenticated principal. The referenced code shows the pattern in DepotItemController (the /depotItem/getMaterialDepotStockByParam handler, lines ~860-881), DepotController (lines ~249-283) and DepotService (lines ~276-313), where depotId/depotIds parameters flow into stock queries without an ownership check against the caller's assignments. Because the queries are read-only lookups, the CVSS 4.0 record scores VC:L with no impact on VI/VA or subsequent-system metrics, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation therefore requires a valid authenticated account in the victim tenant and is only meaningful when depot_flag segregation is enabled; the PoC scripts demonstrate both the stock/warehouse read and a price/bill-line read variant.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user (PR:L) sends a network request with no interaction (AC:L/UI:N); impact is limited read-only data disclosure (C:L), with no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB