Unauthorized Object Access in jshERP

Executive Summary

CVE-2026-94497 is a broken object-level authorization flaw in jshERP versions up to 3.6. It allows authenticated users to read, modify, or delete other users' business objects by directly accessing endpoints with object IDs, bypassing ownership checks. This is an Insecure Direct Object Reference (IDOR) issue where the system fails to validate if a user owns the requested object before performing actions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can use the provided proof-of-concept exploit script from Resource 1. The script requires an authenticated tenant account's X-Access-Token and interacts with jshERP's API endpoints to enumerate object IDs, read objects by ID, and check for unauthorized access. Run the script with safe read operations first to confirm the vulnerability without making changes.

Useful 0 Not Useful 0

Impact Analysis

If you use jshERP through version 3.6, an attacker with a valid account could access, alter, or delete your business data without permission. This includes sensitive information like financial records, inventory, or customer details. The impact ranges from data theft to operational disruption if critical objects are deleted or modified.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data integrity and confidentiality requirements by enabling unauthorized access to personal or sensitive business data. For HIPAA, it could expose protected health information to unauthorized users. Compliance failures may result in legal penalties, reputational damage, and mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to a version beyond 3.6, as the vulnerability affects all versions up to and including 3.6. Ensure proper authorization checks are implemented for all by-id endpoints to validate object ownership before allowing read, modify, or delete operations.

Useful 0 Not Useful 0