CVE-2026-94494

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description A tenant isolation bypass allows authenticated users to access records belonging to other tenants. By iterating the primary key, an attacker can enumerate and retrieve sensitive information across all platform tenants, including login names, validity dates, user quotas, and enabled states. This is possible via the 'GET /tenant/info' endpoint.

Recommendations Update jshERP to version 3.7 or later. As a temporary mitigation, restrict access to the 'GET /tenant/info' endpoint.