{"metadata": {"vulnerability": "CVE-2026-109188", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-10T00:00:00Z", "date_only": false, "value": "2026-10-10T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109188", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T12:57:39.209Z", "date_only": false, "value": "2026-10-12T12:57:39.209Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109188", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T13:10:47.078Z", "date_only": false, "value": "2026-10-12T13:10:47.078Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109188", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T13:10:47.078Z", "date_only": false, "value": "2026-10-12T13:10:47.078Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109188", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T13:17:32Z", "date_only": false, "value": "2026-10-12T13:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V58C-3J5Q-M7JX", "record": "GHSA-V58C-3J5Q-M7JX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T13:17:32.383Z", "date_only": false, "value": "2026-10-12T13:17:32.383", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109188", "record": "FKIE_CVE-2026-109188", "field": "published"}, {"timestamp": "2026-10-12T13:31:46.377Z", "date_only": false, "value": "2026-10-12T13:31:46.377194Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428185055849125", "record": "CVE-2026-109188", "field": "creation_timestamp", "uuid": "b5c461dc-e25d-4468-84fc-8a8f65d8c71e", "content": "CVE-2026-109188 jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109188https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_material_dictionary_write.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_master_data_write_authorization.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_global_config_and_enumeration.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_dictionary_and_config_write.pyhttps://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialAttributeController.java#L63-L69https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialCategoryController.java#L66-L72https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialPropertyController.java#L66-L72https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/AccountController.java#L72-L78https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialController.java#L111-L117https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialController.java#L496-L507https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/OrganizationController.java#L58-L64https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/InOutItemController.java#L64-L70https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/PersonController.java#L65-L71https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/UnitController.java#L62-L68https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-in-master-data-add-and-import-endpoints#jishenghua #jshERP#CVE_2026_109188#bot", "url": "https://infosec.exchange/users/cve/statuses/117428185055849125"}, {"timestamp": "2026-10-12T14:13:11.504Z", "date_only": false, "value": "2026-10-12T14:13:11.504191Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/23ij5s3utrwrz", "record": "CVE-2026-109188", "field": "creation_timestamp", "uuid": "80a936bd-4bdf-41fc-b4e9-06ddfc09ce1b", "content": "CVE-2026-109188 - jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints\nCVE ID : CVE-2026-109188\n \n Published : Oct. 12, 2026, 1:10 p.m. | 13\u00a0minutes ago\n \n Description : jshERP through 3.6 contains a missing authorization vulnerability that allows l...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/23ij5s3utrwrz"}, {"timestamp": "2026-10-12T15:32:15Z", "date_only": false, "value": "2026-10-12T15:32:15Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V58C-3J5Q-M7JX", "record": "GHSA-V58C-3J5Q-M7JX", "field": "published"}, {"timestamp": "2026-10-12T15:32:16Z", "date_only": false, "value": "2026-10-12T15:32:16Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V58C-3J5Q-M7JX", "record": "GHSA-V58C-3J5Q-M7JX", "field": "modified"}, {"timestamp": "2026-10-13T15:10:26.666Z", "date_only": false, "value": "2026-10-13T15:10:26.666625Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109188", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T15:10:26.666Z", "date_only": false, "value": "2026-10-13T15:10:26.666625Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109188", "record": "FKIE_CVE-2026-109188", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T15:10:51.701Z", "date_only": false, "value": "2026-10-13T15:10:51.701Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109188", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:10:51.701Z", "date_only": false, "value": "2026-10-13T15:10:51.701Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109188", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:17:13.913Z", "date_only": false, "value": "2026-10-13T16:17:13.913", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109188", "record": "FKIE_CVE-2026-109188", "field": "lastModified"}]}