The vulnerability allows an authenticated user to read platform‑wide configuration keys by sending requests to /platformConfig/getInfoByKey. The affected code does not check privilege levels for sensitive keys, so low‑privilege tenants can retrieve values such as email_auth_code or activation_code. This exposes SMTP credentials and activation secrets that can be used to compromise email systems or authorize new accounts. The flaw represents a classic CWE‑862 (Broken Access Control) weakness.

The flaw exists in jshERP versions up to and including 3.6. Any deployment of the platform that has not been upgraded to a newer release is potentially vulnerable. The code paths in PlatformConfigController and PlatformConfigService allow the disclosure without additional credentials beyond normal authentication.

The vulnerability is scored CVSS 7.1, indicating a high severity level. EPSS information is not available and it is not listed in CISA KEV. The requirement of only normal authentication allows a legitimate user to retrieve secrets, and because no encryption of the returned data is performed, the sensitive information can be captured easily.