CVE-2026-109187: jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as emailauthcode or activationcode to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user, including a low-privilege user in any tenant, can exploit it. The attacker does not need elevated administrative permissions.
What access and interaction does exploitation require?
Exploitation requires network access to the affected application and valid authenticated credentials with low privileges. No user interaction is required, and the attacker can request arbitrary platformKey values through the affected handler.
Which secrets may be exposed?
Platform-wide configuration values can be read, including SMTP authorization codes identified by email_auth_code and activation secrets identified by activation_code. The handler blocks only aliOss and weixin keys, leaving other requested keys potentially readable.
Are tenant boundaries sufficient to protect platform configuration secrets?
No. A low-privilege user from any tenant can retrieve platform-wide configuration values, so tenant membership does not limit access to these secrets.
What should be done if an immediate update is not possible?
Restrict access to the getInfoByKey handler so that low-privilege users cannot request arbitrary platformKey values, and enforce an allowlist of keys that may be returned. Rotate potentially exposed SMTP authorization codes and activation secrets.