CVE-2026-94495

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94495

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94495.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94495

Published

2026-09-21T18:16:16Z

Modified

2026-09-22T03:31:51Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

jshERP through 3.6 Missing Authorization via systemConfig

Details

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94495.json"
}

References

Affected packages

Git / github.com/jishenghua/jsherp

Affected ranges

Type

GIT

Repo

https://github.com/jishenghua/jsherp

Events

Introduced

Last Affected

8f28e7c2fe54d54de3621a414f5df1833dc5a55f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*

v1.0

v1.5

v2.*

v2.0

v2.1

v2.3

v2.3.1

v3.*

v3.0

v3.1

v3.2

v3.3

v3.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94495.json"