CVE-2026-94495: jshERP through 3.6 Missing Authorization via systemConfig
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The affected update operation does not properly validate whether that user has the privileges required to modify tenant system configuration.
What can an attacker change through the vulnerable endpoint?
An attacker can rewrite or delete tenant-wide system settings, including company identity, stock rules, approval behavior, and printing configuration.
Are unauthenticated deployments exposed?
The available data indicates authentication is required, so an unauthenticated attacker is not described as able to exploit this issue directly.