Description

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:31.157Z",
  "pubdate": "2026-10-12T13:17:31.157Z",
  "executiveSummary": "The jshERP application through version 3.6 is susceptible to an authorization bypass vulnerability stemming from improper input validation in its data retrieval layer.\nThe vulnerability allows authenticated users, who are intended to have restricted access scoped to personal or departmental data, to escalate their data access privileges.\nBy manipulating the request parameters, an attacker can bypass internal filtering mechanisms, resulting in unauthorized access to sensitive organization-wide purchase, sales, and inventory records.\nThis represents a significant security risk, as it effectively nullifies the multi-tenancy or role-based access control (RBAC) constraints established within the ERP system.\nThe attack is performed via a crafted GET request and does not require elevated administrative privileges, only a standard authenticated user session.\nThe exposure of comprehensive business intelligence—specifically financial and inventory data—poses a severe risk of information disclosure, potential competitive damage, and violation of data privacy policies.",
  "technicalDetails": "The vulnerability exists within the application's business logic, specifically affecting the 'DepotHeadService.select' function responsible for querying bill records.\nIn standard operation, the application applies a creator filter to SQL queries to ensure that users limited to specific departments or personal ownership cannot access records generated by other system users.\nThe root cause of this vulnerability is the insecure handling of the 'purchaseStatus' parameter within the 'GET /depotHead/list' endpoint.\nWhen a request is submitted to this endpoint, the application logic processes the provided search JSON to construct the backend query.\nThe implementation of 'DepotHeadService.select' contains a flaw where the inclusion of the 'purchaseStatus' key (specifically 'purchaseStatus=0') in the input JSON causes the underlying query builder to ignore the necessary 'creator' filter.\nStep-by-step exploitation flow: 1. The attacker initiates an authenticated session within jshERP. 2. The attacker navigates to or intercepts the '/depotHead/list' request. 3. The attacker injects 'purchaseStatus=0' into the JSON parameters of the GET request. 4. Upon receipt, the 'DepotHeadService.select' method evaluates the 'purchaseStatus' parameter, which triggers an override in the database query construction process. 5. The application executes a query without the 'creator' constraint, returning a result set containing all tenant purchase, sales, and inventory bills. 6. The response, containing unauthorized data, is returned to the attacker's client.\nBecause the logic fails to enforce authorization checks on the server side once the 'purchaseStatus' parameter is detected, the system fails to re-verify whether the user has the appropriate authorization to view the broader dataset.\nThis vulnerability is restricted to authenticated users, meaning the impact is limited to users who have been granted at least a baseline level of access to the system. However, it circumvents the logical boundaries placed on those users, effectively providing unauthorized cross-departmental data access.\nThe exposure is comprehensive, potentially impacting the entire 'depotHead' data model, which is central to the inventory and procurement management functionalities of jshERP 3.6."
}