jshERP versions up to 3.6 contain an authorization bypass that lets authenticated users supply depotId or depotIds request parameters to access data from warehouses that they are not assigned to. The flaw removes the intended ownership check, enabling the attacker to view detailed stock levels, batch numbers, sales figures, and pricing information for any warehouse within the same tenant.

The vulnerability affects the jishenghua jshERP application up to version 3.6, particularly when the depot_flag warehouse restriction feature is enabled. Any deployment that allows external API calls such as /depotItem/getMaterialDepotStockByParam is susceptible, regardless of the hosting environment.

With a CVSS score of 5.3 the issue is considered moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying limited publicly known exploitation. The attack vector is remote, requiring a valid user session, and once logged on an attacker can read sensitive commercial information across the tenant. The lack of an existing exploit suggests the risk remains primarily a threat of data exposure rather than active code execution.