CVE-2026-94494 in jshERP
Summary
by MITRE • 09/21/2026
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The jshERP software through version 3.6 suffers from a critical insecure direct object reference vulnerability that fundamentally compromises multi-tenant isolation principles. This flaw resides within the GET /tenant/info endpoint, which is designed to return information about specific tenant accounts but fails to enforce proper authorization checks relative to the authenticated user's context. In a properly secured multi-tenancy architecture, an API endpoint must verify not only that the requester is authenticated but also that they possess administrative privileges or ownership rights over the specific resource being requested. The absence of this validation allows any logged-in user to bypass tenant boundaries by manipulating the primary key parameter associated with the request. This represents a classic case where the application trusts client-supplied input without validating it against server-side access control policies, leading to a complete breakdown in data segregation between distinct organizational entities sharing the same infrastructure.
From an operational perspective, this vulnerability enables authenticated attackers to perform systematic enumeration and exfiltration of sensitive tenant metadata across the entire platform. By iterating through sequential primary keys, an attacker can query each endpoint call to gather comprehensive details about every registered organization on the system. The exposed data includes login names, validity dates indicating account expiration or status windows, user quotas which reveal infrastructure capacity limits, and enabled states that indicate active versus inactive accounts. This information is highly valuable for subsequent attack phases such as targeted phishing campaigns, credential stuffing attacks against known valid usernames, or reconnaissance to identify high-value targets based on quota sizes and operational longevity. The ability to map the entire tenant landscape effectively neutralizes the security boundary intended by the multi-tenancy model, turning a shared platform into an open directory of organizational identities.
This vulnerability aligns directly with CWE-639, which describes authorization bypass through resource manipulation, as well as CWE-284 regarding improper access control in web applications. In terms of offensive security frameworks, this behavior maps to the ATT&CK technique T1078, specifically valid accounts and potentially T1592 for gathering victim host information during reconnaissance phases. The exploitation does not require complex payload construction or buffer overflow techniques; it relies solely on logical flaws in access control logic, making it easily exploitable by automated scripts with minimal technical overhead.
Mitigation strategies must focus on implementing robust server-side authorization checks at the API level. Developers should ensure that every request to sensitive endpoints verifies that the authenticated user has explicit permission to view or modify the specific resource identified by the primary key. This can be achieved by maintaining a secure mapping between users and their authorized tenant IDs, ensuring that requests for resources outside this mapped scope are rejected with appropriate HTTP 403 Forbidden responses rather than returning data or error messages that leak information. Additionally, implementing rate limiting on enumeration-prone endpoints can mitigate the speed at which attackers can scan through primary keys to build a complete inventory of tenants. Regular security audits and static code analysis focused on access control logic are essential to prevent similar flaws in future releases.