jshERP versions up to 3.6 contain an authorization bypass flaw that lets an authenticated user set the status field to "1" in the /depotHead/addDepotHeadAndDetail endpoint. By doing so the normal audit permission checks and multi‑level approval workflow are skipped, enabling the creation of audited bills that affect inventory records and reporting. This weakness is a classic example of CWE‑862: Unchecked Permissions or Privilege Escalation.

The vulnerability is present in the jishenghua jshERP application up to and including release 3.6. Users running any 3.6 or earlier builds are at risk until a vendor fix is applied.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, suggesting the exploitation likelihood is not currently high in the wild. However, because the attack requires only a valid authenticated session and an HTTP POST request, an attacker with user credentials can perform the bypass. The impact would be the unauthorized manipulation of financial and inventory data, potentially leading to integrity violations.