Authentication Bypass Vulnerability in WIMOOR by WIMOOR ERP

CVE-2026-111691

What is CVE-2026-111691?

The WIMOOR ERP system contains a serious flaw related to authentication bypass that enables attackers to impersonate any tenant and assume arbitrary privilege levels. This vulnerability arises from the exploitation of an unsigned X-USERINFO header. By directly reaching the backend service ports and bypassing the standard security gateway, malicious actors can craft requests that falsify both the company ID and the user type, including administrator roles. This breach allows unauthorized access to sensitive data such as orders, financial records, and Amazon seller authorizations, posing significant security risks to users and organizations relying on the platform.

References