CVE-2026-110615 — jshERP through 3.6 Missing Authorization via /user/batchSetStatus
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' …
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7