Description

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-21T19:17:20.993Z",
  "pubdate": "2026-09-21T19:17:20.993Z",
  "executiveSummary": "jshERP versions up to and including 3.6 are susceptible to a critical tenant isolation bypass vulnerability.\nThis flaw resides within the application's authorization logic, specifically failing to enforce strict multi-tenant boundary controls during data retrieval requests.\nAuthenticated users can exploit this vulnerability to perform unauthorized access and enumeration of sensitive information belonging to other tenants within the platform.\nThe vulnerability type is classified as an Insecure Direct Object Reference (IDOR) or broken access control, leading to unauthorized data disclosure.\nImpacted data includes sensitive organizational information such as tenant login names, account validity parameters, user quotas, and system configuration states.\nThe risk implication is high, as it compromises the confidentiality of all tenants hosted within a single instance of the jshERP platform.\nExploitation requires an active, authenticated session, allowing any low-privileged user to traverse the entire tenant database without additional elevated privileges.\nThe vulnerability highlights a significant failure in the application's data access layer to validate the ownership of resources requested via specific API endpoints.",
  "technicalDetails": "The vulnerability is situated within the API layer of jshERP, specifically targeting the /tenant/info endpoint. The root cause of this flaw is the lack of server-side authorization checks when processing GET requests for tenant-specific information.\nThe application relies on primary key identifiers to fetch tenant records but fails to verify if the requesting authenticated user has the necessary privileges or organizational relationship to access the requested tenant ID.\nAttack flow begins with an authenticated user identifying the /tenant/info endpoint. Because the application logic does not perform a scoped check against the current session's tenant ID, the backend queries the database using the provided primary key directly from the request parameters.\nAn attacker can automate the exploitation process by iterating through sequential or predictable primary key values. By sending repeated GET requests to the /tenant/info endpoint while incrementing the tenant identifier, an attacker can systematically scrape the entire tenant registry.\nThe server-side response provides a JSON or structured data object containing sensitive administrative details for each enumerated tenant. This disclosure includes, but is not limited to, login names, account validity timelines, defined user quotas, and global tenant states (enabled/disabled).\nThis vulnerability is classified as an IDOR-based Broken Access Control. It bypasses the multi-tenant architecture intended to keep distinct organizations isolated in a shared environment. Because the vulnerability exists at the API level, the attack is performed over standard HTTP protocols and does not require complex binary exploitation.\nPost-exploitation, an attacker gains full visibility into the platform's tenant structure. This information can be utilized for further targeted attacks, such as credential stuffing against identified login names, or reconnaissance for more sophisticated system-wide breaches. The lack of rate limiting or proper authorization filtering on this endpoint allows for rapid enumeration of the global user and tenant database, effectively nullifying the multi-tenancy security model of the jshERP platform."
}