Executive brief
jshERP is an open-source ERP system used by small and medium businesses for inventory, sales, and financial management. An authorization flaw in the system configuration service allows any logged-in user to modify tenant-wide settings, including company identity, stock rules, and approval workflows, without requiring administrator privileges. An attacker with a basic user account can alter critical business configurations.
Technical details
The SystemConfigService.updateSystemConfig endpoint lacks privilege validation, allowing authenticated users with any role to modify the jsh_system_config table via the /systemConfig/update endpoint. The vulnerability is CWE-862 (missing authorization) and requires only a valid authentication token; no network access restrictions are present. An attacker gains the ability to rewrite or delete tenant configuration settings affecting company identity, inventory rules, approval workflows, and printing behavior.
Affected products
- jishenghua jshERP through 3.6
Timeline
- 2026-09-21: disclosed