Executive brief
jshERP is an open-source ERP system for small and medium enterprises that manages inventory, procurement, sales, warehousing, and accounting. An authentication bypass flaw allows any logged-in user to read, modify, and delete business objects (invoices, accounts, depots, etc.) belonging to other users by directly submitting object IDs, potentially leading to unauthorized data access, manipulation, or loss.
Technical details
The vulnerability is a broken object-level authorization (IDOR, CWE-862/CWE-639) in the by-id info, update, and delete endpoints across multiple resource types. The data-scope filter (getCreatorArray) is applied only to list/report queries but not to direct object access endpoints, allowing any authenticated user to bypass ownership checks. An attacker with valid credentials can enumerate and tamper with arbitrary business objects within the same tenant.
Affected products
- jishenghua jshERP through 3.6
Timeline
- 2026-09-21: disclosed