CVE-2026-94495

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description Authenticated users can modify tenant system configuration due to improper validation of user privileges in the updateSystemConfig() function within the SystemConfigService. This allows attackers to rewrite or delete tenant-wide settings, including company identity, stock rules, approval behavior, and printing configuration, via the 'systemConfig' endpoint.

Recommendations Update jshERP to version 3.7 or later. As a temporary mitigation, restrict access to the 'systemConfig' endpoint to only highly privileged administrators.