https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T13:00:55.714021+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109183 CVE-2026-109183 — jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter 2026-10-13T13:00:55.715471+00:00

Affected: jishenghua jshERP

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.