CVE-2026-94497CWE-639

CVE-2026-94497

High · published September 21, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-21T23:17Z
References (4)
https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-12-business-data-horizontal-access.py · [email protected]https://github.com/jishenghua/jshERP · [email protected]https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/MaterialController.java#L119-L125 · [email protected]https://www.vulncheck.com/advisories/jsherp-through-3.6-unauthorized-access-via-by-id-endpoints · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 18:16Z
    jshERP through 3.6 Unauthorized Access via by-id Endpoints
    cvelistv5