CVE-2026-109183

The jshERP software, version 3.6 and below , is vulnerable to an authorization bypass in the POST /depotHead/addDepotHeadAndDetail request. An authenticated user can bypass audit permission checks and multi-level approval workflows by supplying a status of 1 . This allows the unauthorized creatio...

EUVD-2026-97387

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows...