CVE-2026-22788

High

Published: 12/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

WebErpMesv2 prior to version 1.19 exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards.

Risk Assessment

The organization is at risk of confidential business data leakage and unauthorized data modification, potentially leading to significant financial losses and loss of customer trust.

Recommendation

It is recommended to immediately upgrade WebErpMesV2 to version 1.19 or later, which includes a fix for this vulnerability.

Other vulnerabilities in WebErpMesV2

CVE-2026-49827Critical
WebErpMesv2 versions up to 1.19 allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration and broken role middleware, this chain is effectively unauthenticated RCE against any default installation.

Original NVD description (English source)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.