The vulnerability stems from missing authorization checks in several master‑data endpoints of jshERP. An authenticated user with low privileges can send POST requests to paths such as /account/add, /material/add, or /material/importExcel, causing the system to create new settlement accounts, product entries with inventory, departments, and dictionary items across the entire tenant. Because the data inserted is used by other users and processes, an attacker can silently alter business configuration and inventory visibility, thereby undermining data integrity.

This flaw affects jishenghua’s jshERP software, versions up to and including 3.6. The affected components include AccountController.add, MaterialController.add, MaterialController.importExcel, and related data‑management endpoints referenced in the source code links.

With a CVSS score of 5.3 the vulnerability carries moderate severity. No EPSS score is published and the issue is not listed in CISA KEV, suggesting a lower likelihood of widespread exploitation. However, the attack requires only a valid authenticated session; any user with basic application access can use the flaw to create arbitrary master data, which may then assist further compromise of business processes.