| Title | jishenghua jshERP ad6cf886dd4e0676723060a25d361c703dc56bc0 Missing Authorization |
|---|
| Description | jishenghua jshERP contains a missing authorization vulnerability in the financial receipt update functionality. The PUT /accountHead/updateAccountHeadAndDetail endpoint allows an authenticated user with financial editing privileges to modify a receipt or payment that has already been audited without verifying whether the document is still authorized for modification. The service does not load and validate the persisted audit status before applying the submitted changes and does not require the document to be reverse-audited first. As a result, a finalized financial document can be modified while remaining in the audited state. Updating the receipt amount also recomputes the remaining debt of linked business documents, allowing previously finalized settlement data to be altered without returning the document to an unaudited state. In the verified proof of concept, an audited receipt was changed from 30 to 90 while its audit status remained unchanged, and the linked bill's remaining debt changed from 70 to 10. The issue was reproduced at commit ad6cf886dd4e0676723060a25d361c703dc56bc0.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| Source | ⚠️ https://github.com/jishenghua/jshERP/issues/167 |
|---|
| User | cztang (UID 101252) |
|---|
| Submission | 09/18/2026 04:22 (18 days ago) |
|---|
| Moderation | 10/05/2026 18:27 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413644 [jishenghua jshERP up to 3.5 Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization] |
|---|
| Points | 20 |
|---|