CVE-2026-109184: falha de média gravidade em jishenghua jshERP
jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
Publicada em · Atualizada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidade de exploração
0.2%top 90% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
jishenghua · jshERPPoCs públicas encontradas — 1
cve_referencegithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_financial_read_scope_bypass.pynão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — jishenghua jshERP
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1588MEDIUMjishenghua jshERP installByPath install path traversalEPSS 0.7%CVE-2026-94501HIGHjshERP through 3.6 Privilege Escalation via userBusiness CRUDEPSS 0.5%CVE-2026-94413HIGHjshERP through 3.6 Password Hash Disclosure via /user/infoEPSS 0.5%CVE-2026-94412HIGHjshERP through 3.6 Authorization Bypass via resetPwdEPSS 0.5%CVE-2026-94411HIGHjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypeEPSS 0.5%CVE-2026-1549MEDIUMjishenghua jshERP PluginController uploadPluginConfigFile path traversalEPSS 0.5%
Referências
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_financial_read_scope_bypass.pyhttps://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/AccountController.java#L180-L224https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/resources/mapper_xml/AccountMapperEx.xml#L202-L353https://www.vulncheck.com/advisories/jsherp-through-3.6-data-scope-bypass-via-account-findaccountinoutlist