EUVD-2026-97388
GHSA-x2p6-gwmm-696c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege scoped user
-
ExploitCall GET /account/findAccountInOutList with arbitrary accountId
-
ExecutionBackend skips data-scope authorization check
-
ImpactRead other users' settlement ledger data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated jshERP account that is restricted to personal or department-level data scope (PR:L); the attacker then calls GET /account/findAccountInOutList and supplies an arbitrary accountId belonging to another user or department. There are no special product-feature or non-default-configuration prerequisites - the missing scope check is in the default code path. Exploitation is limited to read-only disclosure of settlement account ledger fields (bill numbers, counterparties, amounts, remarks) and is confined to accounts within the same tenant; it does not grant write access, privilege escalation, or cross-tenant access, and it cannot be performed by a fully unauthenticated attacker. |
| Impact | This is a genuine but moderate-severity issue, best characterized as a horizontal/vertical data-scope authorization bypass (IDOR) rather than a critical flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CVSS 5.3 Medium score are internally consistent with the description: exploitation is network-reachable and low-complexity but REQUIRES an authenticated low-privilege account (PR:L), and impact is confined to confidentiality of financial ledger data (VC:L, with VI/VA:N) within the same tenant. Publicly available exploit code exists (a Python POC on GitHub), which lowers the bar to abuse, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. No contradictions exist between the CVSS vector and the description - both agree on authenticated network access with confidentiality-only impact. Net assessment: a real, easily-weaponized insider/low-trust-account data-exposure bug worth prioritizing for environments running jshERP with multiple scoped users, but not an internet-wide emergency given the authentication requirement, read-only impact, and tenant confinement. The 'Authentication Bypass' tag is misleading - CWE-862 (Missing Authorization) and the description confirm the attacker is already authenticated; authentication is not bypassed, authorization scope is. |
| Exploit ScenarioDerived | A low-privilege employee whose account is restricted to personal or department-level financial data authenticates to jshERP and issues GET /account/findAccountInOutList while substituting an arbitrary accountId belonging to another user or department. Because the backend omits a data-scope authorization check, the application returns that account's settlement ledger - bill numbers, counterparties, amounts, and remarks - across the tenant. A public Python POC demonstrating this scope bypass is available on GitHub, making the attack trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Authenticated low-privilege users of jshERP (through version 3.6) can read any tenant settlement account ledger by supplying an arbitrary accountId to the GET /account/findAccountInOutList endpoint, bypassing personal or department-level data scope restrictions. This missing authorization check (CWE-862) discloses bill numbers, counterparties, amounts, and remarks, but remains confined to the same tenant and does not allow writes or privilege escalation. Publicly available exploit code exists, though active exploitation has not been confirmed and the risk is assessed as moderate severity.
RemediationAI
No vendor-released patch has been identified at time of analysis; the only public reference to an exploit is the PoC at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_financial_read_scope_bypass.py. The definitive remediation is to add an authorization check in AccountController.findAccountInOutList that validates the requested accountId against the authenticated user's data scope (personal or department) before returning ledger data. If you cannot modify the application code, apply compensating controls: restrict access to the GET /account/findAccountInOutList endpoint via a reverse proxy, API gateway, or WAF rule to only trusted roles or IP ranges, understanding this may break legitimate functionality for low-privilege users; alternatively, disable the endpoint entirely if settlement account ledger viewing is not required, at the cost of losing that feature. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/jsherp-through-3.6-data-scope-bypass-via-account-findaccountinoutlist) and the vendor repository for an official update, and consider implementing data scope enforcement at the service or gateway layer as a defense-in-depth measure. Authentication for exploitation requires a valid low-privilege account, so reducing the number of such accounts or disabling unused accounts lowers exposure, though it does not fix the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jshERP is a Java Spring Boot application (jshERP-boot) that uses MyBatis mapper XML for database access. The vulnerability is an instance of CWE-862 (Missing Authorization) affecting the AccountController.java (lines 180-224) and its associated mapper AccountMapperEx.xml (lines 202-353). Specifically, the GET /account/findAccountInOutList endpoint fails to enforce a data scope check: it accepts an accountId parameter and returns settlement ledger data without verifying that the accountId falls within the authenticated user's permitted scope (personal or department). This is a classic Insecure Direct Object Reference (IDOR) pattern where the server relies on client-supplied identifiers instead of applying server-side authorization. The flaw exists in the default code path, requiring no special configuration, and allows an attacker with a low-privilege account to horizontally and vertically traverse accounts within the same tenant. The impact is limited to read-only disclosure of financial fields (bill numbers, counterparties, amounts, remarks) and does not extend to cross-tenant access, write operations, or privilege escalation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user (PR:L) exploits a network endpoint with no special complexity or interaction (AV:N/AC:L/UI:N); impact is limited read-only financial data disclosure, so C:L and I/A:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB