All vulnerabilities
CVE-2026-110615

jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jishenghua jshERP
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.

Text from CVE List

Affected versions 1

  • jshERPaffected: all versions through 3.6CVE List

References 5