CVE-2026-109188 — jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints la…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7