CVE-2026-109186
Deferred Deferred - Pending Action

jshERP Mass Assignment Leads to Tenant Switch & Password Overwrite

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109186
EUVD
EUVD-2026-97390

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jishenghua jshERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has a mass assignment vulnerability in the UserController update handler. Authenticated users can send a crafted PUT request to /user/update to overwrite protected fields like tenant_id and password. This allows attackers to switch tenants on login or overwrite password hashes for account takeover.

Detection Guidance

Check for unauthorized PUT requests to /user/update endpoints in jshERP logs. Monitor for requests modifying tenant_id or password fields. Use tools like Burp Suite or curl to test if authenticated users can overwrite protected fields via crafted requests.

Impact Analysis

An attacker could escalate privileges, switch to another tenant, or take over other users' accounts by overwriting password hashes. This could lead to unauthorized access, data breaches, or full system compromise with limited rollback capabilities.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update jshERP to the latest version beyond 3.6. Implement strict input validation to block mass assignment of protected fields like tenant_id and password. Enforce role-based access controls and disable default passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart