jshERP versions up to 3.6 have a missing authorization flaw in the POST /user/batchSetStatus endpoint. An authenticated user with low privileges can supply custom user identifiers and status values, allowing the attacker to change the account status of other users. This capability enables the disablement of every non‑owner account within the tenant or the re‑enablement of accounts that have been disabled, effectively locking out administrators or compromising user access.

The vulnerability affects jishenghua's jshERP product version 3.6 and earlier. No specific patch level information is provided beyond the 3.6 release, but the issue exists in all builds up to that point.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is 0.00436 (less than 1%), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated request from a low‑privilege user who can submit crafted payloads via the exposed endpoint. Once the attacker triggers the endpoint, they can alter the status of other users with no additional access controls, leading to denial of service for administrators and broad account manipulation.