Search
Find a vulnerability
Search criteria
2 vulnerabilities by wimoor-erp
CVE-2026-111691 (GCVE-0-2026-111691)
Vulnerability from nvd – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:17
VLAI
EPSS
VEX
Title
WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
Summary
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:51 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x… | third-party-advisory |
| https://github.com/wimoor-erp/wimoor/blob/ec86736… | technical-description |
| https://www.vulncheck.com/advisories/wimoor-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wimoor-erp | wimoor |
Affected:
0 , ≤ ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4
(git)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111691",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:51:57.554871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:17:17.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wimoor-erp/wimoor",
"product": "wimoor",
"repo": "https://github.com/wimoor-erp/wimoor",
"vendor": "wimoor-erp",
"versions": [
{
"lessThanOrEqual": "ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants\u0027 orders, finance data, and Amazon seller authorizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:47.608Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51"
},
{
"name": "VulnCheck Advisory: WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header"
}
],
"title": "WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111691",
"datePublished": "2026-10-16T17:39:47.608Z",
"dateReserved": "2026-10-16T14:31:20.461Z",
"dateUpdated": "2026-10-16T21:17:17.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111691 (GCVE-0-2026-111691)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:17
VLAI
EPSS
VEX
Title
WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
Summary
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:51 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x… | third-party-advisory |
| https://github.com/wimoor-erp/wimoor/blob/ec86736… | technical-description |
| https://www.vulncheck.com/advisories/wimoor-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wimoor-erp | wimoor |
Affected:
0 , ≤ ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4
(git)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111691",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:51:57.554871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:17:17.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wimoor-erp/wimoor",
"product": "wimoor",
"repo": "https://github.com/wimoor-erp/wimoor",
"vendor": "wimoor-erp",
"versions": [
{
"lessThanOrEqual": "ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants\u0027 orders, finance data, and Amazon seller authorizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:47.608Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51"
},
{
"name": "VulnCheck Advisory: WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header"
}
],
"title": "WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111691",
"datePublished": "2026-10-16T17:39:47.608Z",
"dateReserved": "2026-10-16T14:31:20.461Z",
"dateUpdated": "2026-10-16T21:17:17.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}