{"id":"CVE-2026-111691","kind":"vulnerability","aliases":["CVE-2026-111691"],"related":[],"title":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate…","description":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.","summary":"WIMOOR (wimoor-erp/wimoor, open-source Spring Cloud Amazon-seller ERP) trusts an unsigned X-USERINFO header in every backend service. Anyone who can reach a service port directly (erp 8101, gateway 8099) can forge companyid and usertype=manager/admin and read or write any tenant's data across 247 handlers. No fix exists yet. Found by static review only; not runtime-tested.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wimoor","fixed":[],"affected":"<= ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 (no release tags)","ecosystem":"other"}],"ecosystems":[],"tags":["amazon-sellers","java","multi-tenant","other","self-hosted","spring-cloud","wimoor"],"not_affected_if":["backend-ports-firewalled","gateway-only-access"],"how_to_check":"Check your deployed commit: git -C <checkout> merge-base --is-ancestor ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 HEAD. If it returns 0 and wimoor-common/common-mvc/.../UserInfoFilter.java still parses X-USERINFO unverified, you are affected. Exposure: from outside the gateway, test whether backend ports such as 8101 (erp) and the other service ports answer. Any answer means exposed.","fix":"No patched version or commit published (no release tags; main unchanged). Mitigate: firewall or security-group every backend service port so only the gateway can reach them; expose only the gateway (8099). Have the gateway strip any inbound X-USERINFO. Longer term, sign the header (HMAC) or use mTLS and verify it in UserInfoFilter. Watch wimoor-erp/wimoor for a fix.","status":"open","published_at":"2026-10-16T18:17:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:13:38+00:00","updated_at":"2026-10-23T23:29:56+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:13:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","impact":"high","summary":"WIMOOR through commit ec86736 trusts an unsigned X-USERINFO header, so anyone who can reach its backend service ports directly can impersonate any tenant and any privilege level. An attacker can then read and modify other tenants' orders, finance data, and Amazon seller authorizations.","category":"other","who_cares":["wimoor","multi-tenant","amazon-sellers"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies other tenants' orders and finance data.","analyst_note":"Find the fixed version or patch commit and the vendor advisory for WIMOOR at https://nvd.nist.gov/vuln/detail/CVE-2026-111691, and confirm whether the gateway-bypass exposure is the only path.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["gateway-only-access","backend-ports-firewalled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":2797,"output_tokens":965,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed version or patch commit and the vendor advisory for WIMOOR at https://nvd.nist.gov/vuln/detail/CVE-2026-111691, and confirm whether the gateway-bypass exposure is the only path.","search":"'-111691':17A,20A '-2026':16A,19A '/wimoor':41B '247':89B '8099':73B '8101':71B 'across':88B 'admin':146C 'allow':11A,114C 'amazon':23B,48B,159C 'amazon-sel':22B,47B 'anyon':62B 'attack':12A,115C,131C 'authent':7A,110C 'author':161C 'backend':60B,133C 'bypass':8A,111C,137C 'cloud':35B,46B 'commit':3A,106C 'companyid':76B,142C 'contain':5A,108C 'cve':15A,18A 'data':87B,157C 'direct':69B,136C 'ec86736':4A,107C 'erp':40B,50B,70B 'everi':59B 'exist':93B 'financ':156C 'fix':92B 'forg':75B,141C 'found':95B 'gateway':72B,139C 'handler':90B 'header':57B,130C 'host':32B 'imperson':14A,117C 'java':25B 'level':122C 'manag':144C 'manager/admin':79B 'modifi':152C 'multi':27B 'multi-ten':26B 'open':43B 'open-sourc':42B 'order':155C 'port':68B,135C 'privileg':121C 'reach':65B,132C 'read':81B,150C 'review':98B 'runtim':102B 'runtime-test':101B 'self':31B 'self-host':30B 'seller':24B,49B,160C 'send':124C 'servic':61B,67B,134C 'sourc':44B 'spring':34B,45B 'spring-cloud':33B 'static':97B 'tenant':28B,85B,119C,154C 'test':103B 'trust':51B 'unsign':53B,126C 'userinfo':56B,129C 'usertyp':78B,147C 'valu':148C 'vulner':9A,112C 'wimoor':1A,21A,36B,37B,39B,104C 'wimoor-erp':38B 'write':83B 'x':55B,128C 'x-userinfo':54B,127C 'yet':94B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111691","severity":null,"published_at":"2026-10-16T18:17:52+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111691:453","url":null,"severity":null,"published_at":"2026-10-23T23:29:56+00:00","modified_at":"2026-10-23T23:29:56+00:00","first_seen_at":"2026-10-23T23:29:56+00:00","fetched_at":"2026-10-23T23:29:56+00:00","note":"No fix or vendor advisory exists: no release tags, and main's UserInfoFilter still trusts raw X-USERINFO as of today. Source is the reporter's static-review writeup (hackmd, not run at runtime) plus VulnCheck. Gateway bypass is the confirmed path. Writeup also says the gateway never strips a client-sent X-USERINFO, which I did not verify. No exploitation or public PoC; X count is 0."}],"documents":[{"id":2007,"url":"https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass","title":"WIMOOR ERP: downstream microservices trust a forgeable X-USERINFO header (reporter writeup)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2008,"url":"https://github.com/wimoor-erp/wimoor/blob/main/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java","title":"UserInfoFilter.java on main (still trusts raw X-USERINFO)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2009,"url":"https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header","title":"VulnCheck advisory CVE-2026-111691","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}