CVE-2026-94494CWE-639

CVE-2026-94494

Medium · published September 21, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-21T23:17Z
References (4)
https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-09-tenant-cross-tenant-read.py · [email protected]https://github.com/jishenghua/jshERP · [email protected]https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/TenantController.java#L36-L48 · [email protected]https://www.vulncheck.com/advisories/jsherp-through-3.6-tenant-information-disclosure-via-get-tenant-info · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 18:16Z
    jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
    cvelistv5