CVE-2026-109188
Deferred Deferred - Pending Action

Missing Authorization in jshERP Allows Tenant-Wide Data Creation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109188
EUVD
EUVD-2026-97392

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jishenghua jshERP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has a missing authorization vulnerability where low-privilege authenticated users can create tenant-wide master data without proper role checks. Attackers can exploit endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments, and dictionary entries by sending POST requests.

Detection Guidance

Check for unauthorized POST requests to endpoints like /account/add, /material/add, /material/importExcel, /depot/batchSetStatus, or /material/batchSetStatus. Use tools like curl or Postman to test these endpoints with low-privilege credentials. Monitor logs for unexpected data creation in tenant-shared master data tables such as jsh_account, jsh_depot, or jsh_material.

Impact Analysis

This vulnerability allows unauthorized users to create or modify critical business data such as accounts, materials, and departments. It could lead to financial fraud, data corruption, or unauthorized access to sensitive information. The impact includes potential data integrity issues and unauthorized changes to system configurations.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data creation or modification. GDPR requires strict access controls and data integrity, while HIPAA mandates protection of sensitive health information. Unauthorized changes to master data could lead to non-compliance, data breaches, or loss of audit trails.

Mitigation Strategies

Apply role-based access controls to all master data endpoints. Ensure endpoints like /account/add and /material/add verify user roles before processing requests. Update to the latest patched version of jshERP. Restrict network access to these endpoints to trusted IPs only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart