jshERP: Eleven Authorization Flaws Disclosed in Single Batch, Including Privilege Escalation
Key findings • Eleven authorization vulnerabilities disclosed in jshERP through version 3.6 on October 12, 2026. • High-severity flaws include mass assignment allowing password overwrites and…
Key findings
- Eleven authorization vulnerabilities disclosed in jshERP through version 3.6 on October 12, 2026.
- High-severity flaws include mass assignment allowing password overwrites and privilege escalation via role assignment.
- Multiple CVEs detail authorization bypasses for creating master data, approving bills, and exporting sensitive user information.
- Information disclosure vulnerabilities allow access to platform secrets and manipulation of audit logs.
- All affected versions are through 3.6; users urged to update promptly.
On October 12, 2026, a batch of eleven vulnerabilities was disclosed in jshERP versions through 3.6, with a significant number of these flaws stemming from authorization and access control weaknesses. These vulnerabilities, disclosed on the same day, collectively pose a risk to data integrity, user privilege levels, and system security within the jshERP platform.
Several vulnerabilities center on missing or improper authorization checks, allowing authenticated users to perform actions beyond their intended scope. For instance, CVE-2026-109188 details a missing authorization flaw where low-privilege users can create tenant-wide master data through add and import endpoints without proper role validation. Similarly, CVE-2026-109185 highlights an issue where authenticated users can assign arbitrary roles to any user, enabling privilege escalation.
Other authorization bypasses include CVE-2026-109183, which permits authenticated users to create pre-approved bills by circumventing audit permission checks, and CVE-2026-109182, allowing authenticated users to bypass data scope restrictions and export all supplier, customer, and member records. CVE-2026-109181 enables authenticated users to view other users' bills by adding a purchaseStatus value to a GET request, and CVE-2026-109179 allows access to data from unassigned warehouses by manipulating depotId parameters.
Information disclosure is another key theme, exemplified by CVE-2026-109187, where any authenticated user can read platform-wide configuration secrets, including sensitive details like email authentication codes. Furthermore, CVE-2026-109178 and CVE-2026-109179, both within the LogController, allow low-privilege users to forge, modify, delete, or view audit log entries, potentially erasing tracks of malicious activity or fabricating evidence.
A critical vulnerability, CVE-2026-109186, involves mass assignment in the UserController update handler. This allows authenticated users to overwrite protected fields such as tenant_id and password, enabling them to switch tenants upon their next login or compromise other users' credentials.
The impact of these vulnerabilities ranges from unauthorized data creation and modification to privilege escalation and the exposure of sensitive system configurations and user data. The consistent disclosure of these eleven CVEs on the same date suggests a comprehensive security audit or a coordinated discovery of weaknesses within jshERP 3.6.
All eleven vulnerabilities affect jshERP versions through 3.6. Users are strongly advised to update to a patched version as soon as possible. Specific version information for the patch is not detailed in the provided CVE descriptions, but the vulnerabilities are confirmed to exist in versions up to and including 3.6.
The coordinated disclosure of these eleven authorization-related vulnerabilities underscores the importance of robust access control mechanisms in enterprise resource planning software. Users of jshERP should prioritize applying available patches and reviewing their system's security configurations to mitigate the risks associated with these findings. Further monitoring for any exploitation attempts or related advisories from jshERP is recommended.