CVE-2026-109188: jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated jshERP user can exploit it. The attacker needs network access to the affected application and valid credentials, but does not need elevated roles or user interaction.
Which functions are exposed?
The affected add and import endpoints include examples such as /account/add, /material/add, and /material/importExcel. They can be used to create tenant-wide master data, including settlement accounts, products with initial stock, departments, and dictionary entries.
Are deployments affected by default?
The available information identifies missing role checks on the affected endpoints, but does not state whether any particular deployment configuration disables or restricts them by default. Verify whether low-privilege accounts can submit POST requests to these endpoints.
How can administrators check for attempted or successful exploitation?
Review application and HTTP request logs for POST requests by low-privilege users to master-data add and import endpoints, particularly /account/add, /material/add, and /material/importExcel. Audit master data for unexpected settlement accounts, products or initial-stock entries, departments, and dictionary entries.
What can be done if patching is not immediately possible?
Restrict access to the affected endpoints so low-privilege users cannot send requests to them, and limit application access to trusted users and networks. Review and remove unauthorized master-data records created through these functions.