GHSA-x2p6-gwmm-696cMediumCVSS 4.3
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege...
🔗 CVE IDs covered (1)
📋 Description
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-109184
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_financial_read_scope_bypass.py
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/AccountController.java#L180-L224
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/resources/mapper_xml/AccountMapperEx.xml#L202-L353
- https://www.vulncheck.com/advisories/jsherp-through-3.6-data-scope-bypass-via-account-findaccountinoutlist
- https://github.com/advisories/GHSA-x2p6-gwmm-696c