CVE-2026-110114
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
Description
AI Translation Available
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843…
https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843…
https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843…
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unauth-index-wipe
https://www.vulncheck.com/advisories/oms-erp-through-pre-missing-authentication…