CVE-2026-109186: jshERP through 3.6 Mass Assignment via PUT /user/update
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require administrative access or user interaction?
No. Exploitation requires an authenticated account with low privileges, but no administrative privileges or user interaction. The vulnerable update endpoint is reachable over the network.
Which deployments are exposed?
jshERP versions through 3.6 are affected. Deployments where authenticated users can reach the PUT /user/update endpoint are exposed to crafted update requests.
What is the likely impact of a successful exploit?
An attacker may overwrite protected fields such as tenant_id or password. This can enable cross-tenant access after the next login or takeover of other users' accounts by replacing password hashes.