Description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:30.980Z",
  "pubdate": "2026-10-12T13:17:30.980Z",
  "executiveSummary": "jshERP versions through 3.6 contain an authorization bypass vulnerability affecting the warehouse management module.\nThe vulnerability is categorized as an improper access control issue, allowing authenticated users to bypass intended warehouse-level restrictions.\nBy manipulating request parameters, an attacker can access sensitive inventory data, including stock levels, batch numbers, and financial bill lines for warehouses they are not assigned to.\nThe scope of impact is limited to authenticated users who possess valid session tokens, yet it violates the principle of least privilege within a multi-tenant environment.\nThe vulnerability exists even when the 'depot_flag' warehouse restriction mechanism is explicitly enabled, rendering the intended security control ineffective.\nRisk implications include unauthorized disclosure of sensitive business intelligence, supply chain data, and sales performance metrics, potentially leading to competitive disadvantage or operational exposure.\nExploitation is trivial, requiring only the ability to supply specific, identifiable parameters within HTTP GET requests to vulnerable API endpoints.",
  "technicalDetails": "The root cause of this vulnerability lies in insecure server-side input validation within the warehouse data retrieval controllers of the jshERP application.\nSpecifically, the application fails to verify whether the authenticated user possesses the appropriate permissions for the requested 'depotId' or 'depotIds' before executing database queries associated with these identifiers.\nWhen the 'depot_flag' feature is active, the system is expected to restrict data visibility to only those warehouses authorized for the user's account; however, the implementation relies on client-provided parameters rather than server-side session-based authorization checks.\nThe exploitation flow begins when an authenticated attacker targets the /depotItem/getMaterialDepotStockByParam endpoint. Instead of providing their assigned warehouse ID, the attacker injects arbitrary warehouse identifiers into the request parameters.\nBecause the application logic blindly trusts the input provided in the 'depotId' or 'depotIds' fields, it processes the request and queries the backend database for the associated stock, batch, and sales records regardless of the user's actual access rights.\nThe backend function fails to reconcile the user's organizational context with the requested ID, effectively bypassing the security controls intended to isolate tenant-specific warehouse data.\nThis vulnerability is particularly dangerous as it persists throughout the application's reporting and management modules that leverage similar data retrieval functions.\nAn attacker can systematically enumerate warehouse IDs to map out the entire inventory structure of the target tenant, extract priced bill lines that reveal procurement costs and sales margins, and gain insights into batch-level inventory tracking.\nThe vulnerability persists through jshERP version 3.6, and no specific network-level bypass is required, as the flaw resides entirely within the application layer's authorization logic.\nOnce the target retrieves this data, they can gain unauthorized visibility into highly sensitive operational metrics without triggering traditional authentication-based alerts, as the session itself remains valid throughout the discovery process."
}