Vulnerability in Wimoor-Erp Wimoor
CVE-2026-111691
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass (third-party-advisory)
- github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimo… (technical-description)
- VulnCheck Advisory: WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header (third-party-advisory)
Frequently asked questions
- What is CVE-2026-111691?
- CVE-2026-111691 is a high-severity vulnerability in Wimoor-Erp Wimoor, classified under Authentication Bypass by Spoofing. CVSS score: 7.4/10. Published 2026-10-16.
- How severe is CVE-2026-111691?
- High severity. CVSS v3 base score is 7.4 out of 10.