jshERP EUVD-2026-97385

Requires a valid authenticated jshERP session, even one restricted to personal or department-only data scope (PR:L); no admin rights are needed. The attacker must send a GET /depotHead/list request with purchaseStatus=0 added to the search JSON - this specific parameter presence is what causes DepotHeadService.select to omit the creator/owner filter. No non-default configuration or user interaction is required; the behavior is present in default jshERP through 3.6. The sole limiting factor is the need for any low-privilege authenticated account, which bounds exploitation to insiders or attackers who have otherwise obtained credentials.

This is a genuine but moderate-severity information-disclosure issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L, score 5.3) is internally consistent with the description: a network-reachable, low-complexity bug that requires an authenticated low-privilege account and leaks confidentiality only (no integrity or availability impact). A public POC exists (publicly available exploit code exists), which raises practical exploitability for anyone who already holds a valid jshERP login. However, there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - the absence of these signals is not itself an error, just missing data. The key tension is that PR:L bounds the audience to existing authenticated tenant users (insiders or attackers who have obtained any low-privilege credential), which argues against mass internet-scale exploitation despite AV:N. One nuance to verify: the description says the filter bypass exposes ALL tenant purchase, sales and inventory bills, which is arguably a broader confidentiality impact than the VC:L / C:L rating suggests - defenders handling sensitive commercial data may wish to treat the confidentiality impact as higher than the headline 5.3 implies. Net: real and worth patching, but lower priority than unauthenticated RCE or KEV-listed flaws.

An attacker who already has a low-privilege jshERP account scoped to only their own or their department's records logs in, then issues a GET /depotHead/list request with purchaseStatus=0 injected into the search JSON. Because DepotHeadService.select drops the creator filter when purchaseStatus is present, the server returns every purchase, sales and inventory bill for the entire tenant, leaking commercially sensitive data the user should not see. A public Python POC for this exact request is available.