CVE-2026-111691 Details

An authentication bypass vulnerability has been identified in WIMOOR ERP, specifically in the common-mvc component, through commit ec86736. This vulnerability allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. The issue arises because downstream microservices trust this header without verification. Attackers who can directly access backend service ports, bypassing the gateway, can forge company ID and user type values to read and modify orders, financial data, and Amazon seller authorizations of other tenants.

It is recommended to implement signature verification for the X-USERINFO header at the service level, ensuring that only headers signed by the gateway are accepted. Additionally, backend services should be bound to private interfaces to prevent direct access from outside the network.