CVE-2026-110615: jshERP through 3.6 Missing Authorization via /user/batchSetStatus
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privilege user in a jshERP tenant can exploit it. The attacker does not need administrator privileges or user interaction.
What accounts can be affected?
An attacker can change the status of other users' accounts in their tenant. They can disable every non-owner account, including administrator accounts, or re-enable accounts that were disabled.
Are deployments affected by default?
The issue is present in jshERP through version 3.6 in the POST /user/batchSetStatus endpoint. The provided information does not identify a configuration prerequisite beyond having authenticated low-privilege users.
How can defenders identify attempted exploitation?
Review requests to POST /user/batchSetStatus and account-status changes for unexpected batches of user IDs or status values. Investigate especially if multiple non-owner accounts, including administrators, were disabled or previously disabled accounts were re-enabled.