CVE-2026-109188 in jshERP
Summary
by MITRE • 10/12/2026
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in jshERP versions up to 3.6 represents a critical failure in access control mechanisms, specifically classified under CWE-285 Improper Authorization. This flaw allows authenticated users who possess only low-level privileges to perform administrative actions that should be restricted to higher-ranking roles or system administrators. The core technical issue lies in the absence of role-based checks within specific API endpoints responsible for managing master data. By leveraging these unprotected routes, an attacker can bypass standard permission boundaries and execute operations that fundamentally alter the configuration and operational state of the entire tenant environment.
The attack vector involves sending HTTP POST requests to vulnerable endpoints such as /account/add, /material/add, or /material/importExcel. These interfaces are designed for creating new records but fail to validate whether the requesting user has the necessary authorization level to perform these actions. Consequently, a low-privilege user can inject arbitrary data into the system's master database. This includes creating settlement accounts which may facilitate financial manipulation, adding products with initial stock levels that distort inventory tracking and reporting, establishing departments that alter organizational hierarchy structures, or inserting dictionary entries that affect application behavior across all users within the tenant.
The operational impact of this vulnerability is severe due to its potential for widespread disruption and data integrity compromise. Since jshERP operates on a multi-tenant architecture where master data often defines shared resources and configurations, unauthorized modifications can have cascading effects throughout the system. An attacker could manipulate financial records by creating fraudulent settlement accounts or alter inventory levels by injecting false product stock information. Furthermore, the ability to create new departments or modify dictionary entries allows for significant structural changes that may disrupt workflows, confuse users, or serve as a foothold for further privilege escalation attacks within the application logic.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Account Manipulation and Data Injection. The ability to create new accounts or modify system configurations without proper authorization is indicative of lateral movement potential if those created entities are used to gain deeper access later. Additionally, the import functionality via Excel files introduces risks associated with CWE-732 Incorrect Permission Assignment for Critical Resource, as it allows bulk data injection that can be difficult to audit and trace back to specific malicious actors compared to single-entry forms.
Mitigation strategies must focus on implementing robust role-based access control (RBAC) checks at the API level rather than relying solely on client-side restrictions or UI-level hiding of buttons. Developers should ensure that every endpoint performing sensitive operations, particularly those affecting master data like accounts, materials, and organizational structures, validates the user's current roles against a whitelist of permitted actions before processing the request. Input validation must also be strengthened to prevent injection attacks through the Excel import feature, ensuring that file contents are sanitized and verified for malicious payloads or malformed data structures. Regular security audits and penetration testing should include specific scenarios targeting authorization bypasses on administrative endpoints to detect such misconfigurations early in the development lifecycle.