Executive brief
jshERP is an open-source ERP system for small and medium enterprises. An authenticated user can access sensitive information from other tenants' accounts—including login names, user quotas, and account settings—by exploiting a broken authorization check in the tenant info API endpoint. An attacker with valid credentials can read data from any tenant on the platform without proper access controls.
Technical details
The vulnerability is a broken object-level authorization (IDOR, CWE-639) in the GET /tenant/info endpoint. The jsh_tenant table is exempt from the platform's tenant-filter controls, and the endpoint applies no ownership or permission checks, allowing any authenticated user to enumerate and retrieve tenant records by iterating the primary key. An attacker gains read access to confidential tenant metadata across the entire multi-tenant platform without privilege escalation.
Affected products
- jishenghua jshERP through 3.6
Timeline
- 2026-09-21: disclosed