CVE-2026-94495 — jshERP through 3.6 Missing Authorization via systemConfig
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Atta…
Published: 2026-09-21 · CVSS: 7.1 · CVSS 4.0
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7