CVE-2026-94494
Received Received - Intake

Tenant Isolation Bypass in jshERP Exposes Sensitive Tenant Data

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94494
EUVD
EUVD-2026-84045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jsherp jsherp to 3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has a tenant isolation bypass vulnerability. Authenticated users can read other tenants' records via the GET /tenant/info endpoint by iterating the primary key. This allows enumeration and access to sensitive tenant data like login names, validity dates, user quotas, and enabled state across all platform tenants.

Detection Guidance

To detect this vulnerability, check if the GET /tenant/info endpoint allows unauthenticated or improperly authorized access to tenant records. Use tools like curl to send requests with different tenant IDs and verify if sensitive data is exposed. Example command: curl -H 'X-Access-Token: YOUR_TOKEN' 'http://TARGET/jshERP-boot/tenant/info?id=OTHER_TENANT_ID'

Alternatively, use the provided PoC script from Resource 2 to automate testing. Ensure you have valid credentials for one tenant and attempt to access data from other tenants by iterating through IDs.

Impact Analysis

An attacker with an authenticated account could exploit this to access sensitive data belonging to other tenants. This includes login credentials, system configurations, and operational details. The impact is unauthorized data exposure across tenant boundaries.

Compliance Impact

This vulnerability likely violates data protection requirements in GDPR and HIPAA by enabling unauthorized access to sensitive tenant data. It compromises confidentiality and could lead to regulatory penalties due to inadequate access controls and tenant isolation.

Mitigation Strategies

Immediately upgrade jshERP to a version beyond 3.6 if available. If not, restrict access to the GET /tenant/info endpoint by implementing proper tenant-based authorization checks. Ensure all tenant IDs are validated against the authenticated user's tenant.

Apply network-level controls to block unauthorized access to the endpoint. Monitor logs for suspicious requests attempting to enumerate tenant IDs. Temporarily disable the endpoint if a patch is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart