CVE-2026-94413: jshERP through 3.6 Password Hash Disclosure via /user/info
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user can exploit it. The endpoint accepts supplied user IDs, allowing an attacker to retrieve password hashes for arbitrary user accounts.
What can an attacker do with the disclosed hashes?
The exposed values are unsalted MD5 password digests. An attacker can crack them offline or use them for direct authentication bypass.
How can I determine whether my deployment is affected?
Deployments running jshERP through version 3.6 are affected according to the available information. An authenticated test account can request /user/info for another user's ID and check whether the response includes a password hash.