CVE-2026-109186 — jshERP through 3.6 Mass Assignment via PUT /user/update
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_i…
Published: 2026-10-12 · CVSS: 8.7 · CVSS 4.0
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7