CVE-2026-110114 oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
Unauthenticated attackers can delete and rebuild product search indexes via public maintenance endpoints, causing service degradation and data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110114?
CVE-2026-110114 is a medium-severity missing authorization vulnerability in FJ-OMS oms-erp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
Weakness: CWE-306
Which versions are affected by CVE-2026-110114?
How do I fix CVE-2026-110114?
No fix has been published for CVE-2026-110114 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-110114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110114 exists.
Sources
Also known as GHSA-v986-678g-75hp.