Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

WIMOor ERP lets attackers pretend to be any user

CVE-2026-111691 · published 22 days ago
Summary

The WIMOor ERP system can be tricked into accepting a fake X-USERINFO header, letting anyone pose as any company or role. This lets an attacker read or change other customers' orders, financial records, and Amazon seller settings. Apply the latest update or block direct access to backend ports until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wimoor-erp wimoor <= ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4
Original advisory text
WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published16 Oct 2026
Updated4 Nov 2026
First seen16 Oct 2026
Sources
CVE-2026-111691 · NVD
CVE-2026-111691 · MITRE
CVE-2026-111691 · OSV
Track software like this
Free during beta