---
id: "CVE-2026-111691"
kind: "vulnerability"
aliases: ["CVE-2026-111691"]
title: "WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate\u2026"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wimoor", "fixed": [], "affected": "<= ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 (no release tags)", "ecosystem": "other"}]
ecosystems: []
tags: ["amazon-sellers", "java", "multi-tenant", "other", "self-hosted", "spring-cloud", "wimoor"]
not_affected_if: ["backend-ports-firewalled", "gateway-only-access"]
published_at: "2026-10-16T18:17:52+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111691", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:29:56+00:00"}]
---

# WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate…

WIMOOR (wimoor-erp/wimoor, open-source Spring Cloud Amazon-seller ERP) trusts an unsigned X-USERINFO header in every backend service. Anyone who can reach a service port directly (erp 8101, gateway 8099) can forge companyid and usertype=manager/admin and read or write any tenant's data across 247 handlers. No fix exists yet. Found by static review only; not runtime-tested.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:wimoor affected <= ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 (no release tags) fixed ?

## How to check

Check your deployed commit: git -C <checkout> merge-base --is-ancestor ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 HEAD. If it returns 0 and wimoor-common/common-mvc/.../UserInfoFilter.java still parses X-USERINFO unverified, you are affected. Exposure: from outside the gateway, test whether backend ports such as 8101 (erp) and the other service ports answer. Any answer means exposed.

## Fix

No patched version or commit published (no release tags; main unchanged). Mitigate: firewall or security-group every backend service port so only the gateway can reach them; expose only the gateway (8099). Have the gateway strip any inbound X-USERINFO. Longer term, sign the header (HMAC) or use mTLS and verify it in UserInfoFilter. Watch wimoor-erp/wimoor for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111691
- 2026-10-23T23:29:56+00:00 analyst — No fix or vendor advisory exists: no release tags, and main's UserInfoFilter still trusts raw X-USERINFO as of today. Source is the reporter's static-review writeup (hackmd, not run at runtime) plus VulnCheck. Gateway bypass is the confirmed path. Writeup also says the gateway never strips a client-sent X-USERINFO, which I did not verify. No exploitation or public PoC; X count is 0.

## Documents

- [advisory] WIMOOR ERP: downstream microservices trust a forgeable X-USERINFO header (reporter writeup) https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass
- [advisory] VulnCheck advisory CVE-2026-111691 https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header
- [describes] UserInfoFilter.java on main (still trusts raw X-USERINFO) https://github.com/wimoor-erp/wimoor/blob/main/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java

## From the sources

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_