jshERP versions up to 3.6 contain a missing authorization check in SystemConfigService.updateSystemConfig, allowing any authenticated user to alter tenant‑wide settings such as company identity, stock rules, approval behavior, and printing configuration. The flaw enables an attacker to compromise the integrity of the application by inserting or deleting configuration values, leading to operational disruption and potential policy violations.

The vulnerability affects the jshERP product from jishenghua. All releases through version 3.6 are impacted, including the systemConfig endpoint exposed via the SystemConfigController module.

The vulnerability has a CVSS score of 7.1, indicating a high level of risk. The EPSS score is not available and the issue is not listed in CISA KEV. Exploitation requires an authenticated user with any valid account; attackers can send requests to the systemConfig endpoint to modify configuration values. Because the affected setting is tenant‑wide, abuse could affect all users and operations within the tenant. The lack of external exposure does not reduce the threat, as many organizations heavily rely on the exposed endpoint for routine administrative tasks.