jshERP CVE-2025-7947

Upgrade jshERP to version 3.6 or later, which should include authorization checks in the account deletion logic. As an interim compensating control, restrict access to the /user/delete endpoint to administrative users only via network controls or reverse proxy rules, and implement audit logging for all account deletion requests to detect unauthorized attempts. Additionally, validate that the ID parameter in deletion requests matches the authenticated user's own account or is performed by users with explicit administrative privileges. If upgrading is not immediately possible, disable the /user/delete endpoint entirely and handle account deletions through administrative interfaces with stronger access controls. Monitor authentication logs for suspicious activity patterns suggesting credential compromise. Test all compensating controls thoroughly before deployment to avoid blocking legitimate administrative functions.