Description
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Published: 2026-09-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Title jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
First Time appeared Jishenghua
Jishenghua jsherp
Weaknesses CWE-639
CPEs cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*
Vendors & Products Jishenghua
Jishenghua jsherp
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

Jishenghua Jsherp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-21T19:19:58.792Z

Reserved: 2026-09-21T17:52:00.703Z

Link: CVE-2026-94494

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T19:17:20.993

Modified: 2026-09-21T19:17:20.993

Link: CVE-2026-94494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key