CVE-2026-94497 — jshERP through 3.6 Unauthorized Access via by-id Endpoints
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delet…
Published: 2026-09-21 · CVSS: 8.7 · CVSS 4.0
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7