{"schema":"threatline.record/2","record":{"id":"CVE-2026-110114","aliases":[],"summary":"oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints","details":"FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.","categories":["Unclassified"],"product":"oms-erp","vendor":"FJ-OMS","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110114","source_modified_at":"2026-10-14T15:46:12.426Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"oms-erp","vendor":"FJ-OMS","versions":[{"version":"0","lessThanOrEqual":"34d8852bc51aadac8927bd6af706d70c8a407280","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00407,"percentile":0.339,"score_date":"2026-10-23"},"published_at":"2026-10-13T16:53:12.711Z","modified_at":"2026-10-14T15:46:12.426Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110114","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T15:46:12.426Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110114","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unauth-index-wipe","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/GoodsSkuController.java#L123-L131","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/SpuController.java#L104-L111","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/app/service/impl/SkuEsServiceImpl.java#L276-L301","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/oms-erp-through-pre-missing-authentication-via-skyer-goods-es-test-endpoints","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-14T15:45:35.414634Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T15:46:12.426Z","content_hash":"6c75ed9a1e7c71984f96d84cee1d9884e7e8736610d3c32699e5a4d955c90d4a"}}