CVE-2026-110114 Details

A missing authentication vulnerability has been identified in FJ-OMS oms-erp versions through PRE. This vulnerability allows unauthenticated attackers to delete and rebuild product search indexes by accessing public Elasticsearch maintenance endpoints in the skyer-goods service. Attackers can repeatedly call the SKU endpoint to empty the shared SKU index for all tenants and force full-table reloads, degrading search availability.

Remove the 'permissionPublic = true' attribute from the 'es-test' handlers in both the 'GoodsSkuController' and 'SpuController' classes. This change should be accompanied by a restriction that requires authentication and limits access to users with an administrator role. In the medium term, consider moving the reindex and delete operations behind an internal-only entry point that cannot be accessed through the gateway, and replace the current deletion and reindexing method with a more efficient approach that does not disrupt live search availability.