CVE-2026-109188

The jshERP software, through version 3.6 , is vulnerable to a missing authorization vulnerability (CWE-862). This flaw allows low-privilege authenticated users to bypass role checks and create tenant-wide master data by sending POST requests to specific endpoints. Affected endpoints include /acco...