CVE-2026-94495CWE-862broken-access-control

CVE-2026-94495

High · published September 21, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-21T23:17Z
References (4)
https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-via-systemconfig · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-10-systemconfig-tamper.py · [email protected]https://github.com/jishenghua/jshERP · [email protected]https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/SystemConfigController.java#L93-L115 · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 18:16Z
    jshERP through 3.6 Missing Authorization via systemConfig
    cvelistv5