CVE-2026-110615 jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

CVE-2026-110615

The jshERP software, up to version 3.6 , is vulnerable to a missing authorization issue in the POST /user/batchSetStatus endpoint. This flaw allows authenticated low-privilege users to modify the account status of other users within their tenant. By submitting crafted IDs and status values, an at...

EUVD-2026-101243

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

CVE-2026-110615 jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...