The vulnerability allows authenticated users to submit a crafted PUT request to the /user/update endpoint, resulting in a mass assignment that overwrites protected fields such as tenant_id and password. This gives attackers the capability to switch tenants on their next login or replace other users' password hashes, enabling full account takeover. The weakness is a form of improper input validation and authorization (CWE-915).

The affected product is jshERP from the vendor jishenghua, versions up to and including 3.6 are impacted. No other versions are listed as vulnerable.

With a CVSS score of 8.7 the vulnerability is considered high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires a legitimate authenticated session; attackers transmit a crafted JSON payload to the sensitive endpoint, leveraging the unchecked assignment of protected fields. The impact is full access to other tenants and complete control over user credentials within the affected instance.