CVE-2026-94412: jshERP through 3.6 Authorization Bypass via resetPwd
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the authorization bypass in the jshERP POST /user/resetPwd endpoint by enforcing proper authorization checks so an authenticated user cannot reset an arbitrary target user ID’s password.
jshERP POST /user/resetPwd authorization checks = enforce authorization so users can reset only their own account
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated as a jshERP user. No additional privileges or user interaction are required.
Can this be used to take over administrative accounts?
Yes. An authenticated user can target arbitrary user IDs and reset other accounts' passwords, including administrator accounts, to the known default value.
Which deployments are affected?
jshERP versions through 3.6 are affected where the POST /user/resetPwd endpoint is present.