CVE-2026-109184: jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege user whose data scope is restricted to personal or department records can exploit it. The issue affects access to settlement account ledgers within the same tenant.
What does an attacker need to do?
The attacker needs a valid authenticated account and an arbitrary target accountId. They can submit it to GET /account/findAccountInOutList to retrieve ledger data outside their authorized scope.
What information could be exposed?
Unauthorized users may view other users' settlement-account ledger entries, including bill numbers, counterparties, amounts, and remarks.