A missing authentication flaw in oms-erp’s skyer‑goods es‑test maintenance endpoints allows any unauthenticated client to delete and force rebuild the shared product search index. Repeated calls to /v1/goods/sku/es-test can empty the goods_sku_index_01 index for all tenants, causing full‑table reloads and markedly degrading search availability. The vulnerability is classified as CWE‑306 and does not expose data corruption or exfiltration beyond index loss.

The flaw affect FJ‑OMS’s oms‑erp product. Specific version information is not listed in the advisory, so any deployed instance may be susceptible until guidance is released by the vendor.

With a CVSS of 6.9, this medium‑severity issue presents a moderate risk when an attacker can reach the public es‑test endpoints. The EPSS is not available and the vulnerability is not yet in the KEV catalog, but the known attack vector is external, no authentication required, and escalates to a denial of service. A malicious actor can repeatedly issue the request, potentially causing prolonged search unavailability for all tenants.