CVE-2026-110114
oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
FJ-OMS oms-erp
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.
Text from CVE List
Affected versions 1
- oms-erpaffected: all versions through 34d8852bc51aadac8927bd6af706d70c8a407280CVE List
References 5
- vulncheck.com/advisories/oms-erp-through-pre-missing-authentication-via-skyer-goods-es-test-endpointsAdvisoryvia CVE List
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unauth-index-wipeExploitvia CVE List
- github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/GoodsSkuController.java#L123-L131Referencevia CVE List
- github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/SpuController.java#L104-L111Referencevia CVE List
- github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/app/service/impl/SkuEsServiceImpl.java#L276-L301Referencevia CVE List