jshERP CVE-2026-109182

Requires a valid authenticated jshERP account (PR:L) that is deliberately restricted to personal- or department-level data scope; the flaw is that GET /supplier/exportExcel does not re-apply the role data-scope filtering enforced by /supplier/list. The practical precondition is a multi-role deployment where data-scope restrictions are actually configured - in a single-admin install there is no privilege boundary to cross. Limiting factors: attacker must already hold credentials and network access to the application; no privilege escalation or code execution results - impact is confidentiality only (read/export of supplier, customer and member records).

This is a medium-severity information-disclosure flaw (CVSS 4.0 base 5.3) whose real-world priority is moderate, not critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach, low complexity, no user interaction, but PR:L - meaning a valid authenticated account on the jshERP instance is a hard prerequisite, which substantially gates mass exploitation. The vendor scored confidentiality impact as VC:L; however the described data exposed (every supplier, customer and member record including bank accounts, tax numbers and balances) is arguably a more serious confidentiality loss, so the VC:L rating may understate impact - treat 5.3 as a floor. Exploitation signals are mixed: public POC code exists (increasing ease of reproduction), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. Net assessment: a credible, easily-reproduced authorization/data-scope bypass that matters most to organizations running jshERP with multiple restricted user roles, but the authentication requirement and the product's niche footprint keep it below emergency-patch priority absent targeting.

A low-privileged jshERP user whose role restricts them to their own or their department's data authenticates normally, then directly requests GET /supplier/exportExcel instead of using the scope-enforced /supplier/list view. The export endpoint omits the data-scope check, returning an Excel file containing every supplier, customer and member record - contacts, phone numbers, tax IDs, bank accounts and balances. A public Python POC (poc_supplier_partner_scope_bypass.py) demonstrates the request, lowering the skill barrier.