Vulnerability details

CVE-2026-111691

wimoor-erp wimoor

WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

CVSS 4.0

9.1Critical

Official description

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

CVSS scores

Score	Version	Source	Vector
9.1Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
7.4High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
wimoor-erp	wimoor	v ≤ ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4	CVEProject cvelistV5 (CNA)

References and advisories

https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass third-party-advisory
https://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51 technical-description
https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-16
Last updated: 2026-10-17
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 23 · Low

Exploit prediction (EPSS)

0.4%

Probability of exploitation in 30 days

35.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-290
Authentication Bypass by Spoofing