The vulnerability enables an authenticated user to trigger the GET /supplier/exportExcel endpoint in jshERP through version 3.6. The endpoint does not apply the role-based data scope checks enforced by /supplier/list, allowing the user to export all supplier, customer and member data. This exposure includes contact details, telephone numbers, tax identifiers, bank account information and financial balances. The weakness represents an incorrect authorization flaw (CWE‑863).

The impacted product is jshERP by jishenghua. Any release up to and including version 3.6 contains the vulnerable SupplierController and SupplierService components. Users running these versions are susceptible to the export scope bypass.

With a CVSS score of 5.3 the vulnerability is considered medium severity. The EPSS score is not publicly available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only that the attacker has valid credentials within the system; no additional privilege escalation or remote code execution is needed. Once accessed, the attacker can obtain a comprehensive set of business and financial data, potentially leading to identity theft, fraud or competitive disadvantage. Because legitimate users can abuse the endpoint, the threat is significant for organizational security.