jshERP versions up to 3.6 contain a tenant isolation bypass that lets authenticated users read data belonging to other tenants. The GET /tenant/info endpoint lacks proper ownership checks, enabling attackers to iterate primary keys and retrieve login names, validity dates, user quotas, and enabled state for any tenant. This exposes confidential tenant information and could aid further credential or privilege escalation activities.

The vulnerability impacts the jishenghua jshERP application, specifically all releases up to and including version 3.6. The affected code is located in the TenantController class in the jshERP source repository.

The CVSS score of 5.3 classifies the issue as moderate severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account and knowledge or guessing of tenant identifiers, but the absence of ownership validation makes enumeration trivial via a simple GET request, making the attack feasible with minimal effort once credentials are available.