{"metadata": {"vulnerability": "CVE-2026-111691", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111691", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:20.461Z", "date_only": false, "value": "2026-10-16T14:31:20.461Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111691", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:47.608Z", "date_only": false, "value": "2026-10-16T17:39:47.608Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111691", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:47.608Z", "date_only": false, "value": "2026-10-16T17:39:47.608Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111691", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:52Z", "date_only": false, "value": "2026-10-16T18:17:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H72P-HRWQ-PW25", "record": "GHSA-H72P-HRWQ-PW25", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:52.493Z", "date_only": false, "value": "2026-10-16T18:17:52.493", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111691", "record": "FKIE_CVE-2026-111691", "field": "published"}, {"timestamp": "2026-10-16T18:34:52Z", "date_only": false, "value": "2026-10-16T18:34:52Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H72P-HRWQ-PW25", "record": "GHSA-H72P-HRWQ-PW25", "field": "published"}, {"timestamp": "2026-10-16T18:34:52Z", "date_only": false, "value": "2026-10-16T18:34:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H72P-HRWQ-PW25", "record": "GHSA-H72P-HRWQ-PW25", "field": "modified"}, {"timestamp": "2026-10-16T18:48:18.150Z", "date_only": false, "value": "2026-10-16T18:48:18.150447Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452076414204814", "record": "CVE-2026-111691", "field": "creation_timestamp", "uuid": "ee86ff48-39a6-41e0-89a3-8cdda9d23510", "content": "CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111691https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypasshttps://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header#wimoor-erp #wimoor#CVE_2026_111691#bot", "url": "https://infosec.exchange/users/cve/statuses/117452076414204814"}, {"timestamp": "2026-10-16T20:09:34.887Z", "date_only": false, "value": "2026-10-16T20:09:34.887510Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzez4ydrz27", "record": "CVE-2026-111691", "field": "creation_timestamp", "uuid": "00c2c0bc-c560-46b8-bb13-d6a5325200fe", "content": "\ud83d\udea8 CVE-2026-111691 \u2014 CVSS 9.1 CRITICAL\n\nWIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111691\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzez4ydrz27"}, {"timestamp": "2026-10-16T20:51:57.554Z", "date_only": false, "value": "2026-10-16T20:51:57.554871Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111691", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T20:51:57.554Z", "date_only": false, "value": "2026-10-16T20:51:57.554871Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111691", "record": "FKIE_CVE-2026-111691", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T21:00:04.800Z", "date_only": false, "value": "2026-10-16T21:00:04.800767Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzhtgirmm2w", "record": "CVE-2026-111691", "field": "creation_timestamp", "uuid": "327cdcbf-c091-4f67-908b-0435a3a0e764", "content": "CVE-2026-111691 - wimoor\nThe WIMOor ERP system can be tricked into accepting a fake X-USERINFO header, letting anyone pose as any company or role. This lets an attacker read or change other customers'\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wimoor #wimoorerp #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzhtgirmm2w"}, {"timestamp": "2026-10-16T21:17:17.620Z", "date_only": false, "value": "2026-10-16T21:17:17.620Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111691", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:17:17.620Z", "date_only": false, "value": "2026-10-16T21:17:17.620Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111691", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:17:22.613Z", "date_only": false, "value": "2026-10-16T22:17:22.613", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111691", "record": "FKIE_CVE-2026-111691", "field": "lastModified"}]}