The vulnerability is an authorization bypass that allows an authenticated user to include purchaseStatus=0 in a GET /depotHead/list request. This parameter causes the service to drop the creator filter and return all tenant purchase, sales and inventory bills, exposing data that the user should not access. The weakness is a CWE-863 (Authorization Bypass Through User-Controlled Key).

Affected are jishenghua jshERP versions up to 3.6, as identified by the vendor's name and the release line available in the supplied cpe. No later version information is present, so any instance running 3.6 or earlier is impacted.

The CVSS score of 5.3 indicates a moderate severity — the flaw does not allow arbitrary code execution but leads to unauthorized data disclosure. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, so the exploitation likelihood is unknown. It is likely to be exploited by authenticated users who have permission to view receipts; the attack requires only issuing a crafted request to the application.