CVE-2026-105621
Deferred Deferred - Pending Action

Improper Authorization in jshERP Financial Receipt Update

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105621
EUVD
EUVD-2026-92937

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
jishenghua jshERP 3.0
jishenghua jshERP 3.1
jishenghua jshERP 3.2
jishenghua jshERP 3.3
jishenghua jshERP 3.4
jishenghua jshERP 3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization flaw in jishenghua jshERP up to version 3.5. It exists in the updateAccountHeadAndDetail function of the Financial Receipt Update Handler. The issue allows remote attackers to manipulate audited financial receipts without reversing their audit status, enabling unauthorized changes to amounts and linked debt settlements while bypassing intended workflow controls.

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to the /accountHead/updateAccountHeadAndDetail endpoint in jshERP. Check for modifications to audited financial receipts without prior reverse-audit. Review logs for unauthorized changes to document amounts or debt settlements while marked as audited.

Impact Analysis

An attacker could exploit this to alter audited financial records, leading to incorrect financial reporting, fraudulent transactions, or unauthorized debt adjustments. Since the system allows any authenticated tenant user to edit documents without ownership validation, it poses risks of data tampering and financial discrepancies for affected organizations using the software.

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and audit trails, such as GDPR's accountability principle or HIPAA's integrity and audit controls. Unauthorized modifications to financial records may result in non-compliance, potential fines, and loss of trust due to compromised data accuracy and auditability.

Mitigation Strategies

Immediately restrict access to the PUT /accountHead/updateAccountHeadAndDetail endpoint. Ensure updates to audited receipts require reverse-audit validation. Enforce caller-ownership checks to prevent unauthorized user modifications. Apply input validation to reject updates unless the document status is '0' (un-audited).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart