CVE-2026-94494: jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user can exploit it. The attacker needs only low-privileged access and network reachability to the GET /tenant/info endpoint; no user interaction is required.
What information can be exposed?
An attacker can enumerate other tenants by iterating primary-key values and retrieve tenant records. Exposed fields include login names, validity dates, user quotas, and enabled-state information.
Are deployments affected by default?
The provided information identifies jshERP through version 3.6 as affected and does not describe any non-default feature or configuration prerequisite. The vulnerable endpoint is GET /tenant/info.
How can I determine whether exploitation may have occurred?
Review application or reverse-proxy logs for authenticated requests to GET /tenant/info, particularly repeated requests with sequential or varied primary-key values. Such patterns may indicate tenant enumeration attempts.