CVE-2026-110114
oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
| CWE | CWE-306 |
| Vendor | fj-oms |
| Product | oms-erp |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for fj-oms oms-erp
Be the first to know when new medium vulnerabilities affecting fj-oms oms-erp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
FJ-OMS / oms-erp
0 ≤ 34d8852bc51aadac8927bd6af706d70c8a407280
References
hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unauth-index-wipe github.com: https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/GoodsSkuController.java#L123-L131 github.com: https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/SpuController.java#L104-L111 github.com: https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/app/service/impl/SkuEsServiceImpl.java#L276-L301 vulncheck.com: https://www.vulncheck.com/advisories/oms-erp-through-pre-missing-authentication-via-skyer-goods-es-test-endpoints
Credits
hieuPenguinnn