Description

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T19:17:20.217Z",
  "pubdate": "2026-09-21T19:17:20.217Z",
  "executiveSummary": "The jshERP platform, specifically versions through 3.6, contains an authorization bypass vulnerability located within the POST /user/resetPwd endpoint.\nThis vulnerability allows any authenticated user to maliciously reset the password of any other registered user, including high-privileged administrator accounts.\nThe flaw stems from insufficient server-side authorization checks, enabling an attacker to manipulate the target identifier within an API request.\nSuccessful exploitation results in full account takeover, posing a critical risk to data confidentiality, system integrity, and platform availability.\nExploitation requires active authentication within the application, but does not require administrative privileges, significantly increasing the attack surface.\nThe vulnerability grants an attacker the ability to establish unauthorized access to sensitive user accounts by forcing a reset to a pre-defined default value.",
  "technicalDetails": "The vulnerability is identified as an Improper Authorization flaw within the jshERP application logic, specifically targeting the password reset mechanism.\nThe POST /user/resetPwd endpoint fails to implement robust server-side validation to ensure that the user requesting the password reset possesses the necessary permissions to perform the action on the specified target identifier.\nThe root cause is a broken object-level authorization (BOLA) pattern where the backend logic trusts the user-supplied input for the target account ID without verifying ownership or administrative entitlement.\nThe exploitation flow begins with a standard authenticated user session within jshERP. Once authenticated, the attacker constructs an HTTP POST request targeting the /user/resetPwd endpoint.\nBy manipulating the request body to include an arbitrary 'userId' parameter corresponding to a victim account, the attacker bypasses the application's intended scope.\nThe server processes the request and executes the password reset function for the provided ID, reverting the target account password to a hardcoded or known default value.\nBecause the system fails to validate the current user's authority to reset the target, the request is executed successfully.\nFollowing the password reset, the attacker gains the ability to authenticate as the victim, effectively escalating privileges to the target account's level.\nThis mechanism is particularly critical when the target user is an administrator, as it grants the attacker elevated management access, enabling them to compromise the entire system configuration, modify financial records, or exfiltrate sensitive data managed by jshERP.\nThe lack of restrictive access control on this administrative function makes it a high-severity entry point for attackers seeking horizontal or vertical privilege escalation.\nThe vulnerability is exposed over the network, and the simplicity of the attack flow allows for automated exploitation using standard intercepting proxies or scripting tools."
}