CVE-2026-109187 — jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler o…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7