CVE-2026-94412

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description An authorization bypass exists in the 'POST /user/resetPwd' endpoint. This flaw allows authenticated users to reset the password of any other user, including administrators, by submitting a request with an arbitrary target user ID via the user id variable. This enables unauthorized access to other accounts by resetting passwords to a known default value.

Recommendations Update jshERP to a version newer than 3.6. As a temporary workaround, restrict access to the 'POST /user/resetPwd' endpoint to minimize the risk of exploitation.