CVE-2026-94495

jshERP through 3.6 is affected by a missing authorization flaw in SystemConfigService.updateSystemConfig , accessible via the systemConfig endpoint. The service fails to properly validate user privileges, allowing any authenticated user to rewrite or delete tenant-wide settings covering company i...