CVE-2026-109186 Details
Description
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
A mass assignment vulnerability has been identified in jshERP versions through 3.6, specifically within the UserController's update handler. This vulnerability allows authenticated users to overwrite protected fields such as tenant_id and password. By sending a crafted PUT request to the /user/update endpoint, attackers can manipulate these fields, potentially leading to unauthorized access or account takeover. The absence of proper authorization checks in the identity module facilitates this exploitation.
Users are advised to update to a version of jshERP that includes the authorization checks in the UserController update handler.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jshERP | <= 3.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |