CVE-2026-94495

jshERP through 3.6 is affected by a missing authorization flaw in SystemConfigService.updateSystemConfig , accessible via the systemConfig endpoint. The service fails to properly validate user privileges, allowing any authenticated user to rewrite or delete tenant-wide settings covering company i...

PT-2026-96208

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description Authenticated users can modify tenant system configuration due to improper validation of user privileges in the updateSystemConfig function within the SystemConfigService. This allows attackers to rewri...

EUVD-2026-68690

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-79744: Improper Privilege Management

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...