Description

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:32.383Z",
  "pubdate": "2026-10-12T13:17:32.383Z",
  "executiveSummary": "jshERP versions through 3.6 contain a critical missing authorization vulnerability residing in administrative creation and import endpoints.\nThe vulnerability stems from the absence of server-side role-based access control (RBAC) checks on sensitive API functions.\nThis security flaw allows authenticated users with low privileges to perform unauthorized administrative actions, effectively granting them the ability to modify tenant-wide master data.\nThe impact includes the unauthorized creation of financial settlement accounts, the injection of malicious product inventory data with initial stock, and the manipulation of organizational structure metadata such as departments and system dictionaries.\nThe vulnerability represents a significant risk to data integrity and business operations, as it permits lateral movement within the application's configuration without requiring elevated administrative tokens.\nExploitation is trivial, requiring only an authenticated session and the capability to craft standard HTTP POST requests directed at the vulnerable application endpoints.",
  "technicalDetails": "The vulnerability is classified as a Missing Function Level Access Control, stemming from a failure to enforce authorization logic at the controller or service layer for specific API endpoints.\nAffected endpoints include, but are not limited to, /account/add, /material/add, and /material/importExcel. In the architecture of jshERP versions through 3.6, these endpoints are exposed to authenticated users without validating if the requester possesses the required 'admin' or 'super-user' roles.\nThe root cause lies in the application's design, which assumes that the UI-based restriction of these features is sufficient to prevent unauthorized access. However, because the backend logic fails to perform session-based permission verification upon receiving the request, the API is inherently insecure.\nThe attack flow follows a predictable pattern: 1) An attacker authenticates with standard, low-privilege credentials. 2) The attacker identifies the vulnerable POST endpoints through reconnaissance of the application's traffic or documentation. 3) The attacker constructs a malicious HTTP POST request, often including JSON payloads for master data modification or multipart/form-data for Excel imports. 4) The application processes the request, bypassing privilege checks, and commits the unauthorized entries to the underlying database.\nExploitation allows for the mass creation of arbitrary records. For instance, by invoking /material/importExcel, an attacker can import a malicious spreadsheet containing thousands of fabricated product entries, potentially leading to supply chain confusion, inventory poisoning, or the creation of backdoors via system dictionaries. Similarly, the /account/add endpoint can be abused to create unauthorized financial accounts, which could be used to facilitate internal financial fraud or reconcile fraudulent transactions.\nThe vulnerability exists in the server-side code responsible for handling master data management. Since the application does not verify the requester's authorization level before executing the persistence logic, the system effectively trusts any input provided by an authenticated user. This lack of granular access control is present across multiple modules, indicating a systemic failure in the implementation of the security middleware across the jshERP platform for the affected versions."
}