CVE-2026-105621: jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low-level privileges can exploit the improper authorization in the Financial Receipt Update Handler. No user interaction is required.
Are deployments running the default configuration affected?
The available information identifies jishenghua jshERP through version 3.5 as affected and does not describe any configuration prerequisite or mitigation. Deployments using the affected Financial Receipt Update Handler should be treated as exposed.
Is public exploitation information available?
Yes. An exploit has been released publicly and may be used in attacks, increasing the urgency of remediation and monitoring.
What is the likely impact of successful exploitation?
Successful exploitation can result in unauthorized modification of financial receipt data, with low integrity and availability impact indicated. No confidentiality impact is identified.