EUVD-2026-97391
GHSA-47x2-rrvv-xffp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant user
-
ExploitCall getInfoByKey with sensitive platformKey
-
ExecutionBypass aliOss/weixin-only blocklist
-
ImpactRetrieve SMTP and activation secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold a valid authenticated jshERP account at any privilege level and belonging to any tenant (PR:L) - no admin rights and no user interaction are needed. The specific trigger is the getInfoByKey handler of PlatformConfigController, whose blocklist only rejects the platformKey values aliOss and weixin; any other key (e.g. email_auth_code, activation_code) is returned, so exploitation works against default configurations with no special feature toggle. Limiting factors: exploitation is gated on obtaining or already possessing a low-privilege login, affected versions are jshERP through 3.6, and impact is confined to confidentiality (secret disclosure) with no direct integrity or availability effect. |
| Impact | Signals partially align toward a real but bounded priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a remotely reachable, low-complexity flaw requiring only a low-privilege authenticated account, with high confidentiality impact (VC:H) and no integrity/availability impact - consistent with the CWE-862 (Missing Authorization) description of an authenticated user reading secrets they should not access. Public exploit code exists (a Python PoC in the referenced GitHub repo), which materially raises practical exploitability, but this is NOT the same as confirmed active exploitation: there is no CISA KEV listing provided, so exploitation status is 'publicly available exploit code exists,' not 'in the wild.' EPSS and SSVC decision data were NOT supplied in the input and cannot be assessed - treat exploitation-probability modeling as unknown. The main risk discount is that exploitation is authenticated (PR:L) and the product itself is niche open-source ERP software with limited deployment, so blast radius is narrow even though the per-instance impact (leaked SMTP authorization codes and activation secrets that could enable further compromise) is meaningful. Net: a legitimate credential/secret-disclosure issue to patch, elevated by public PoC, but not a mass-exploitation emergency on the available evidence. |
| Exploit ScenarioDerived | A low-privilege user of any tenant on a shared jshERP deployment logs in with their normal account and sends a request to the getInfoByKey endpoint of PlatformConfigController supplying a sensitive platformKey such as email_auth_code or activation_code. Because the handler only blocks the aliOss and weixin keys, it returns the platform-wide SMTP authorization code and activation secret, which the attacker can reuse to send spoofed mail or unlock protected functionality. A public Python PoC demonstrating this enumeration is available, lowering the skill required to exploit it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Authenticated information disclosure in jshERP through 3.6 exposes platform-wide configuration secrets, including SMTP authorization codes (email_auth_code) and activation codes (activation_code), to any logged-in user of any tenant at any privilege level via the getInfoByKey handler of PlatformConfigController. The endpoint applies a denylist that blocks only aliOss and weixin keys, so every other platformKey value is returned unredacted; no admin rights and no user interaction are required, though a valid low-privilege account is a prerequisite (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; NVD score 7.1). Publicly available exploit code exists - a proof-of-concept script that performs global configuration retrieval and enumeration is hosted on GitHub - but no CISA KEV entry confirms active exploitation, and impact is confined to confidentiality with no integrity or availability effect.
RemediationAI
No vendor-released patch identified at time of analysis: neither the vendor advisory nor the referenced GitHub sources (jishenghua/jshERP at commit 8f28e7c2fe54d54de3621a414f5df1833dc5a55f) point to a tagged fixed release, and no fix version is published. Apply compensating controls in the interim. First, replace the denylist with an allowlist in PlatformConfigService (lines 154-171) and enforce role checks in PlatformConfigController.getInfoByKey so that only platform administrators can read secret-bearing keys - the trade-off is that legitimate low-privilege UI features that read harmless configuration keys must be re-enumerated and explicitly permitted, or they will break. Second, if code changes are not possible, block or restrict POST/GET requests to the PlatformConfig getInfoByKey endpoint at the reverse proxy or WAF for non-admin sessions or for any platformKey value outside a small operational allowlist; this may break client pages that fetch configuration at runtime. Third, treat all platform secrets as compromised and rotate the SMTP authorization code (email_auth_code) and activation_code values and any credentials historically stored in the platform config table, accepting that outstanding activation flows using the old codes will be invalidated. Fourth, monitor jshERP access logs for getInfoByKey calls from low-privilege or cross-tenant accounts and review the public PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_global_config_and_enumeration.py to build detection signatures. Consult https://www.vulncheck.com/advisories/jsherp-through-3.6-information-disclosure-via-platformconfig-getinfobykey for updated vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jshERP is an open-source Java/Spring Boot ERP platform whose administrative configuration is stored in a platform config table and served through PlatformConfigController. The vulnerable getInfoByKey handler (lines 201-216 of PlatformConfigController.java) delegates to PlatformConfigService (lines 154-171), which performs an authorization decision by checking the requested platformKey against a hard-coded denylist containing only aliOss and weixin. This is the CWE-862 Missing Authorization pattern: because the check is a denylist rather than a role- or allowlist-based control, any key outside those two names - for example email_auth_code, activation_code, or any other secret-bearing configuration entry - is returned verbatim to the caller. The root cause is an inverted/insufficient access-control policy on a sensitive read endpoint rather than a memory-safety or injection flaw, so exploitation requires only an authenticated session (PR:L) over the network (AV:N) with no user interaction and no special feature toggle; the upstream controller and service source at commit 8f28e7c2fe54d54de3621a414f5df1833dc5a55f still show the denylist logic, and the affected version range is jshERP through 3.6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable web handler (AV:N/AC:L) exploitable by any low-privilege authenticated user (PR:L) with no UI; discloses secrets so C:H, with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.
Technical POC Analysis
CWE-862 (Missing Authorization) in the getInfoByKey handler of PlatformConfigController (annotated by the PoC as PlatformConfigController.java:221-236).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
jshERP versions through 3.6 suffer from an authenticated information disclosure vulnerability that lets any low-privileged tenant user retrieve platform-wide configuration secrets, including SMTP authorization codes and activation codes. This exposes sensitive credentials that could enable email account takeover, lateral movement, and further compromise of connected systems, affecting all tenants and undermining trust in the platform. Leadership should act urgently because publicly available exploit code exists, even though no CISA KEV entry confirms active exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations include blocking or restricting the getInfoByKey endpoint to administrators only via WAF/reverse proxy, rotating all SMTP authorization codes and activation codes, enforcing least privilege for tenant accounts, and monitoring logs for anomalous configuration retrieval. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB