CVE-2026-94497
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.
Faiblesse
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.
Références
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-12-business-data-horizontal-access.py
- https://github.com/jishenghua/jshERP
- https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialController.java#L119-L125
- https://www.vulncheck.com/advisories/jsherp-through-3.6-unauthorized-access-via-by-id-endpoints
Trouvez la faille avant un attaquant.
Connectez-vous avec GitHub et lancez votre premier audit en moins d'une minute. L'offre gratuite ne nécessite aucune carte bancaire.