CVE-2026-110615 in jshERP
Summary
by MITRE • 10/14/2026
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in jshERP versions up to 3.6 represents a critical failure in access control mechanisms, specifically classified under CWE-284 as Improper Access Control. This flaw resides within the POST /user/batchSetStatus endpoint, which is designed to manage user account statuses such as enabling or disabling accounts. The core technical deficiency lies in the server-side validation logic, which fails to verify whether the authenticated user initiating the request possesses the necessary administrative privileges to modify the status of other users. Instead of restricting this operation exclusively to high-privilege administrators, the application accepts requests from any authenticated low-privilege user and processes them without adequate authorization checks against the target account's ownership or role hierarchy.
From an operational perspective, this vulnerability allows for a severe denial-of-service attack within the context of multi-tenant environments. An attacker with standard user privileges can exploit this flaw by submitting crafted HTTP POST requests containing specific identifiers (ids) and status values set to disable. By iterating through available user IDs, the attacker can systematically disable every non-owner account in their tenant. This action effectively locks out all administrators and other legitimate users who rely on these accounts for system access, resulting in a complete disruption of business operations. Furthermore, the vulnerability is bidirectional; an attacker could also re-enable previously disabled accounts, potentially bypassing security controls that were intentionally applied to restrict access for specific individuals or groups.
This type of attack aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions, and can be categorized under privilege escalation behaviors where a low-privilege user gains the ability to manipulate administrative functions. The impact extends beyond simple account lockout; it undermines the integrity of the system's identity management framework and compromises the availability of critical enterprise resources. In scenarios where jshERP is used for sensitive business processes, such as finance or supply chain management, this disruption can lead to significant financial loss and operational paralysis until access is manually restored by external means or through emergency recovery procedures that may not be readily available during an active attack.
Mitigation strategies must focus on implementing robust server-side authorization checks at the API level. Developers should ensure that any endpoint modifying user states verifies that the requesting user holds a role with explicit permission to manage other users, such as Admin or Super-User roles. Additionally, input validation should be enforced to restrict the scope of batch operations, preventing mass updates unless explicitly authorized by policy. Implementing rate limiting on this specific endpoint can also help mitigate automated exploitation attempts. For organizations currently running affected versions, immediate patching to a version where this authorization logic is corrected is essential. In the interim, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block anomalous patterns of batch status changes originating from low-privilege accounts until the software update is applied.