CVE-2026-109184
Deferred Deferred - Pending Action

Improper Authorization in jshERP Exposes Settlement Account Ledgers

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109184
EUVD
EUVD-2026-97388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jishenghua jshERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has an improper authorization vulnerability. Low-privilege authenticated users can read any settlement account ledger by providing an arbitrary accountId. Attackers with limited data access can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts, and remarks within the same tenant.

Detection Guidance

Check for unauthorized access to the GET /account/findAccountInOutList endpoint by reviewing server logs for unusual queries with arbitrary accountId parameters. Monitor for low-privilege users accessing settlement account ledgers outside their assigned scope.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive financial data of other users within the same system. Attackers could view bill numbers, counterparties, transaction amounts, and remarks, potentially leading to data breaches or financial fraud.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and financial data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. The breach could result in legal penalties and loss of compliance certifications.

Mitigation Strategies

Apply vendor patches if available. Restrict access to the /account/findAccountInOutList endpoint to authorized roles only. Implement strict input validation to prevent arbitrary accountId queries. Review and audit user permissions to ensure proper authorization boundaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart