Description

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:31.663Z",
  "pubdate": "2026-10-12T13:17:31.663Z",
  "executiveSummary": "jshERP versions through 3.6 are affected by an improper authorization vulnerability within the settlement account ledger retrieval mechanism.\nThis flaw allows low-privilege authenticated users to bypass intended data scope restrictions.\nBy manipulating the accountId parameter in requests to the /account/findAccountInOutList endpoint, unauthorized users can perform Insecure Direct Object Reference (IDOR) attacks.\nThe vulnerability permits attackers to query and view sensitive financial ledger information, including bill numbers, counterparties, transaction amounts, and internal remarks, that exist outside of their assigned personal or departmental data scope.\nThe risk implication is significant as it results in unauthorized information disclosure of sensitive corporate financial data, potentially compromising multi-tenant isolation within the application.\nExploitation requires an authenticated session with low-level privileges but does not necessitate elevated administrative rights.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization check during the server-side processing of requests to the /account/findAccountInOutList endpoint.\nIn a secure multi-tenant environment, the application is expected to validate that the requested accountId belongs to the user's specific data scope before processing the query; however, the application fails to perform this access control validation.\nThe vulnerability manifests as an Insecure Direct Object Reference (IDOR), where the system trusts the user-supplied accountId parameter without cross-referencing it against the requesting user's identity or authorization context.\nAn authenticated attacker can perform the following attack flow: 1) Authenticate to the jshERP platform using a standard low-privilege user account. 2) Intercept or construct a GET request directed at the /account/findAccountInOutList endpoint. 3) Systematically iterate or inject arbitrary numerical values into the accountId query parameter. 4) The backend application processes the request by querying the database for all records associated with the supplied accountId, regardless of the tenant's hierarchical data scope settings.\nUpon successful manipulation, the application returns a JSON payload containing sensitive financial transaction data, including bill identifiers, counterparty details, transactional amounts, and internal remarks.\nThis behavior bypasses the intended multi-tenancy logical separation, allowing an attacker to enumerate financial data across the entire organization or even across different tenant boundaries if the database query scope is not properly isolated at the DAO level.\nThe vulnerability affects jshERP through version 3.6. It is specifically triggered within the controller or service layer responsible for handling account ledger lookups where the authorization logic is omitted or improperly implemented.\nThe post-exploitation impact includes unauthorized sensitive information disclosure, which can lead to privacy violations, exposure of proprietary financial strategy, and potential reconnaissance for further lateral movement or business logic exploitation."
}