jshERP through version 3.6 does not validate ownership of objects on by-id information, update, and delete endpoints. Authenticated users can read, modify, or delete other users’ business objects by simply submitting direct object identifiers, leading to confidentiality and integrity violations.

The affected product is jishenghua jshERP version 3.6. The vulnerability exists across multiple resource types using by-id operations, such as those handled by MaterialController and other similar controllers.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate likelihood of active exploitation. The attack vector likely requires valid user authentication, after which an attacker can send requests with arbitrary identifiers to exposed endpoints. If the application is reachable over a network, an attacker can leverage this flaw to compromise data confidentiality and integrity for other users.