The vulnerability is an improper authorization flaw that allows a low‑privileged authenticated user to request any settlement account ledger by specifying an arbitrary accountId. The attacker can retrieve bill numbers, counterparties, amounts and remarks from other users’ accounts within the same tenant, leaking sensitive financial information.

The affected product is jshERP, version 3.6 and earlier, provided by jishenghua. The flaw resides in the /account/findAccountInOutList endpoint and is exposed to any user that has authenticated credentials but only a low‑level role.

With a CVSS score of 5.3, the vulnerability falls into a moderate severity category. There is no EPSS data available, and the flaw is not listed in the CISA KEV catalog, indicating that it is not currently in widespread exploitation. The likely attack vector is a crafted HTTP GET request to /account/findAccountInOutList with an arbitrary accountId supplied as a query parameter; the attacker only needs an authenticated session with standard user privileges. The risk stems from the potential disclosure of confidential financial records, which could compromise trust and regulatory compliance.