Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110114— oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

Quick assessment

Affected
FJ-OMS oms-erp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FJ-OMS oms-erp 在前端（PRE）环境中存在一个缺失身份认证的漏洞，未授权攻击者可通过调用 skyer-goods 中的公共 es-test 维护接口，删除并重建商品搜索索引。攻击者可反复请求 /v1/goods/sku/es-test 接口，清空所有租户共享的商品索引 goods_sku_index_01，并强制触发全量数据重新加载，从而导致搜索服务的可用性下降。

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
FJ-OMS oms-erp ≤ 34d8852bc51aadac8927bd6af706d70c8a407280 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110114

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FJ-OMS oms-erp 0 ~ 34d8852bc51aadac8927bd6af706d70c8a407280 -

II. Public POCs for CVE-2026-110114

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110114

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110114 (1)

Vendor Advisories for CVE-2026-110114 (1)

Proof of Concept for CVE-2026-110114 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-110114

No comments yet

Leave a comment