jshERP EUVD-2026-101243

Exploitation requires an authenticated low-privilege account within the same jshERP tenant (CVSS PR:L) and the ability to reach the POST /user/batchSetStatus endpoint over the network; no user interaction, admin rights, or non-default configuration is needed because the endpoint is missing its authorization check by design. The primary limiting factor is the authentication requirement - the attacker must already be a valid user - which confines impact to insiders or anyone who can obtain low-privilege credentials, and scope is bounded to accounts within the attacker's own tenant.

The CVSS 4.0 base score of 7.1 (HIGH) is driven almost entirely by the availability impact (VA:H) - an attacker can mass-disable accounts and lock out administrators within their tenant - while confidentiality is untouched (VC:N) and integrity is limited (VI:L). The vector is network-reachable with low complexity and no user interaction (AV:N/AC:L/AT:N/UI:N), but critically requires existing low-privilege authentication (PR:L), so this is a privileged-insider / post-authentication escalation issue rather than a pre-auth internet-wide threat. No EPSS score was provided in the input, and there is no CISA KEV listing and no explicit POC flag, so there is no public-exploitation signal to elevate priority beyond the CVSS figure; however, the referenced HackMD write-up and VulnCheck advisory describe the flaw and the vulnerable source lines in enough detail that weaponization is trivial. SSVC-style reading: exploitation status is 'none' (no confirmed active use), the attack is automatable (a single crafted POST with id/status arrays), and technical impact is partial (account lockout/DoS within a tenant, not full system takeover). Net: a genuine but context-bounded priority - treat as HIGH in multi-tenant jshERP deployments where untrusted low-privilege users exist, and lower where all authenticated users are trusted. Note the input 'Authentication Bypass' tag is slightly misleading: CWE-862 and the description confirm this is a missing-authorization flaw exploited by an already-authenticated user, not an authentication bypass - verify tag semantics before triaging.

A low-privilege user who already holds valid credentials in a jshERP tenant sends a crafted POST to /user/batchSetStatus containing other users' ids and a disabled status value. Because the endpoint performs no ownership or role check, the request succeeds and disables every non-owner account - including administrators - producing a tenant-wide lockout, or alternatively re-enables previously disabled accounts. No public exploit code is identified, but the VulnCheck advisory and HackMD analysis document the exact vulnerable controller/service code.