CVE-2026-94411

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

CVE-2026-48975

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

CVE-2026-48826

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

EUVD-2026-84046

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495

jshERP through 3.6 is affected by a missing authorization flaw in SystemConfigService.updateSystemConfig , accessible via the systemConfig endpoint. The service fails to properly validate user privileges, allowing any authenticated user to rewrite or delete tenant-wide settings covering company i...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

EUVD-2026-84045

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-94494

jshERP through 3.6 contains a tenant isolation bypass vulnerability in the GET /tenant/info endpoint (TenantController.java). Authenticated users can iterate the primary key to enumerate records of other tenants, exposing sensitive data such as login names, validity dates, user quotas, and enable...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

EUVD-2026-84041

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

CVE-2026-94411

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint (located in UserBusinessController.java). An authenticated low-privilege tenant user can send a POST request with type=UserRole, their own user ID, and an arbitrary role ID list to grant themselv...

CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

CVE-2026-48826

HomeBox , a home inventory and organization system, contains an authorization flaw in HandleWipeInventory (backend/app/api/handlers/v1/v1_ctrl_actions.go). The endpoint POST /v1/actions/wipe-inventory checks the global ctx.User.IsOwner value instead of the caller's role in the active group, which...

EUVD-2026-84036

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

CVE-2026-48826 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...