WIMOOR ERP: Authentication bypass via forged X-USERINFO header
Summary
WIMOOR, an open-source ERP for Amazon sellers, trusts the X-USERINFO header that the gateway normally sets, and its backend services do not verify it. An attacker who can reach a backend service port directly, bypassing the gateway, can forge the tenant (companyid) and privilege (usertype) values and act as any tenant or administrator. This can expose or modify orders, finance data and Amazon seller authorizations of other tenants. The CVE record and the vendor code reference cover the commit ec86736 and earlier; no fixed version is known.
Affected
- WIMOOR up to and including commit ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4 (default branch main, no release tag)
- CNA data: wimoor-erp / wimoor, versions <= ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4
- Affected component: common-mvc UserInfoFilter (wimoor-common) and the advertising service copy of the filter
Fixed in
Unknown.
Workaround
- Do not expose backend service ports to untrusted networks; only the gateway should be reachable from outside.
- Configure the gateway to remove or overwrite any client-supplied X-USERINFO header before forwarding requests (recommendation based on the root cause, not a vendor measure).
- Treat any self-hosted WIMOOR instance as unpatched until a fixed version is confirmed.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of active exploitation or CISA KEV listing found.
- Public proof-of-concept: unclear, not verified.
Our recommendation
- Check whether WIMOOR is used in your environment, including hosted or third-party deployments.
- Verify that backend service ports are not reachable from the internet or untrusted networks and that only the gateway is exposed.
- Apply the gateway header filtering as an interim measure.
- Ask the vendor for a fixed version or a patch timeline and check the GitHub repository for later commits.
- Monitor logs for requests to backend services that do not come through the gateway and for unexpected cross-tenant data access.
- Rotate credentials for Amazon seller authorizations if exposure cannot be ruled out.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vulnerable code: UserInfoFilter.java (commit ec86736) github.com
- HackMD write-up: trusted X-USERINFO header hackmd.io
- VulnCheck advisory www.vulncheck.com
- VulDB: CVE-2026-111691 vuldb.com
- Strix: CVE-2026-111691 www.strix.ai
- PT vulners aggregation: PT-2026-116090 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:24.
Original description (NVD)
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.