EUVD-2026-97392
GHSA-v58c-3j5q-m7jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitPOST to /material/add or /material/importExcel
-
ExecutionBypass missing role check
-
ImpactInject tenant-wide master data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated jshERP account with only low privileges; the attacker then reaches the add and import endpoints (e.g. /account/add, /material/add, /material/importExcel, and the dictionary/organization/unit/person controllers referenced by NVD) which perform authentication but omit role/authorization checks. No special non-default configuration or user interaction is needed beyond possessing any low-privilege tenant login, and no admin rights are required - the limiting factor is solely the need for that low-privilege authenticated session (PR:L), which bounds the threat to insiders or attackers who have otherwise obtained credentials. Impact is limited to creating/injecting master data (integrity), not reading or deleting existing data. |
| Impact | This is a moderate-severity broken-access-control issue, not a critical priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a base score of 5.3 correctly reflects a network-reachable, low-complexity flaw that nonetheless REQUIRES an authenticated low-privilege account (PR:L) and yields only limited integrity impact (VI:L; VC:N, VA:N) - attackers can create unauthorized master data but cannot read or destroy data through this flaw alone. Publicly available exploit code exists (four PoC scripts on GitHub), which raises practical exploitability for anyone who already holds a valid low-privilege tenant account, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent: the authorization gap is real and confirmed by direct source-line references to the vulnerable controllers, but the pre-condition of valid authentication plus the integrity-only, create-only impact keep real-world risk in the medium band rather than critical. EPSS data is MISSING and should be checked before final prioritization; absence of KEV combined with the PoC suggests opportunistic or insider abuse rather than mass exploitation. |
| Exploit ScenarioDerived | A low-privilege user who already has a valid jshERP account (for example a limited operator in a multi-tenant deployment) sends crafted POST requests to add/import endpoints such as /account/add, /material/add or /material/importExcel, which lack server-side role checks. Because the endpoints only verify authentication and not authorization, the attacker injects settlement accounts, products with initial stock, departments and dictionary entries affecting the entire tenant. Four public PoC scripts automate dictionary/config writes, master-data writes and enumeration, lowering the skill needed to abuse it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authorization checks in jshERP through 3.6 let any authenticated low-privilege user create tenant-wide master data - settlement accounts, products with initial stock, departments, units, and dictionary entries - because the add and import endpoints authenticate the caller but never verify role or permission. Publicly available exploit code exists in the form of PoC scripts (poc_master_data_write_authorization.py, poc_dictionary_and_config_write.py, poc_global_config_and_enumeration.py, poc_material_dictionary_write.py) that demonstrate the abuse against endpoints such as /account/add, /material/add, and /material/importExcel. The impact is bounded to data integrity within the attacker's own tenant (no confidentiality or availability loss) and requires a valid low-privilege login, making this a moderate-severity broken-access-control issue rather than a critical priority; NVD rates it 5.3 while our independent assessment is consistent with a moderate, integrity-only impact.
RemediationAI
No vendor-released patch was identified at time of analysis: the upstream jshERP links for this CVE are source-code references to the vulnerable controllers at commit 8f28e7c2fe54d54de3621a414f5df1833dc5a55f rather than fix commits or a tagged patched release, and no fixed version is given in the available data, so operators should treat every deployment up to and including 3.6 as unpatched and plan an upgrade as soon as the project ships an authorization fix. Until then, the most effective compensating control is to enforce the missing role check outside the application, for example by writing a small Spring filter/interceptor (or a reverse-proxy/WAF rule in front of jshERP) that rejects POSTs to /account/add, /material/add, /material/importExcel and the other master-data add/import paths unless the session carries an administrative role; the trade-off is ongoing maintenance against upstream route changes and a risk of false positives blocking legitimate admin workflows. Because the vulnerability is only reachable with a valid low-privilege login, tighten identity hygiene in parallel - disable or closely control self-registration and open account provisioning, audit existing low-privilege accounts, rotate credentials that may have leaked, and restrict network exposure of the ERP admin interface to trusted networks or VPN, accepting that this reduces but does not eliminate risk from malicious insiders. Finally, enable audit logging/monitoring for creation events on settlement accounts, materials with initial stock, departments, units, and dictionary entries (and for unexpected Excel imports) so that abuse of these endpoints is at least detected, recognizing that detection is a detective, not preventive, measure. Reference the vendor-neutral advisory at https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-in-master-data-add-and-import-endpoints and the public PoCs (https://github.com/AnkesKasty/cve-request-poc) when validating exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jshERP is a Java Spring Boot ERP/inventory application (jshERP-boot module) that implements a multi-tenant model where user roles are expected to gate administrative master-data operations. The affected code is a set of Spring MVC controllers - AccountController, MaterialController, InOutItemController, OrganizationController, PersonController, UnitController, MaterialCategoryController, MaterialAttributeController, and MaterialPropertyController - whose add/import handler methods (for example AccountController lines 72-78 and MaterialController lines 111-117 and 496-507 at commit 8f28e7c2fe54d54de3621a414f5df1833dc5a55f) are mapped behind the application's authentication filter but omit the subsequent role/permission check. This is the classic CWE-862 (Missing Authorization) root cause: the framework enforces 'who are you' (authenticated session) but not 'are you allowed to do this' (authorization), so any principal that has passed authentication reaches privileged write logic. The vulnerability is sometimes tagged 'Authentication Bypass', but that label is a misnomer here - the request is fully authenticated and the weakness is purely an absent authorization decision on write/import endpoints (including the Excel import path, which additionally creates inventory stock records).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoints with low complexity, but a low-privilege authenticated account is required (PR:L); impact is create-only data integrity (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB