{"id":"CVE-2026-110114","title":"FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods","summary":"FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can r…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-306"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:17:35.520","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110114","references":[{"url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/GoodsSkuController.java#L123-L131","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/api/controller/v1/SpuController.java#L104-L111","label":"disclosure@vulncheck.com"},{"url":"https://github.com/FJ-OMS/oms-erp/blob/14486c98280afd2e0372866f8f2345e2e2b32843/skyer-goods/src/main/java/org/skyer/goods/app/service/impl/SkuEsServiceImpl.java#L276-L301","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unauth-index-wipe","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/oms-erp-through-pre-missing-authentication-via-skyer-goods-es-test-endpoints","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-13T17:38:53.188Z","slug":"CVE-2026-110114","body":"## Overview\n\nFJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}