The flaw resides in the POST /user/resetPwd endpoint of jshERP up to version 3.6, where authentication is insufficiently verified before permitting a password reset. An attacker who has obtained any user credential can submit a request with an arbitrary target user ID, causing the system to overwrite that user’s password with a known default value. This allows the attacker to subsequently log in as the target, including administrators, thereby achieving full account takeover.

The vulnerability affects jishenghua’s jshERP product in versions up to and including 3.6. Administrators and end‑users of these installations are susceptible if they are able to authenticate to the application.

The high CVSS score of 8.7 indicates a severe risk level. Because the attacker only requires valid credentials to a non‑privileged account, the exploitation barrier is low. The system exposes a predictable and straightforward HTTP POST endpoint, making the attack vector likely internal or remote with authenticated access. EPSS information is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, but the known exploitation scenario suggests that the threat is real and potentially impactful in environments where multiple users share the same network or have compromised credentials.