Missing Authentication Flaw in FJ-OMS OMS-ERP Through PRE
CVE-2026-110114

6.9MEDIUM

Key Information:

Vendor

Fj-oms

Status
Oms-erp
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110114?

The oms-erp product by FJ-OMS suffers from a vulnerability that enables unauthenticated attackers to exploit public maintenance endpoints associated with product search indexes in skyer-goods. Specifically, attackers can issue repeated requests to clear the shared goods_sku_index_01 index for all tenants, causing a severe degradation in search capabilities. This lack of authentication allows malicious users to manipulate search infrastructure without any level of authorization, thereby impacting the overall functionality and integrity of the product search feature.

Affected Version(s)

oms-erp 0 <= 34d8852bc51aadac8927bd6af706d70c8a407280

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test...
third-party-advisory
https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e03...
technical-description
https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e03...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.