CVE-2026-110615 Details
Description
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
A missing authorization vulnerability has been identified in jshERP versions through 3.6, specifically in the POST /user/batchSetStatus endpoint. This vulnerability allows authenticated low-privilege users to change the account status of other users. By submitting crafted IDs and status values, attackers can disable all non-owner accounts within their tenant, effectively locking out administrators, or re-enable previously disabled accounts.
The vulnerability can be remediated by implementing proper authorization checks on the server side for all user-management endpoints. This includes verifying that the caller's role grants the necessary permissions before allowing actions such as changing account statuses, deleting users, or creating new accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jshERP | <= 3.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |