CVE-2026-94494 — jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers c…
Published: 2026-09-21 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7