Description

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T19:17:21.427Z",
  "pubdate": "2026-09-21T19:17:21.427Z",
  "executiveSummary": "The jshERP application through version 3.6 contains an improper access control vulnerability within the SystemConfigService component.\nThis flaw allows authenticated, low-privileged users to invoke the updateSystemConfig function, effectively bypassing intended authorization checks.\nThe vulnerability poses a significant risk to system integrity, as it permits unauthorized modification or deletion of tenant-wide configuration settings.\nAttackers can leverage this access to manipulate critical operational parameters, including company identity, stock management rules, approval workflows, and printing configurations.\nThe vulnerability requires authenticated access to the system, but does not mandate elevated administrative privileges, significantly expanding the potential attack surface within a multi-tenant environment.",
  "technicalDetails": "The vulnerability resides in the SystemConfigService.updateSystemConfig function of the jshERP application, which fails to enforce adequate authorization checks on incoming requests. In a multi-tenant environment, this function is intended to be restricted to administrative users who possess the authority to modify global system configurations.\nThe root cause is an insufficient validation logic that fails to verify the identity and privilege level of the authenticated user against the requested resource modifications. Because the application logic does not properly validate whether the authenticated subject possesses sufficient permissions before executing configuration updates, any authenticated user can submit malicious requests to the /systemConfig endpoint.\nThe exploitation flow initiates when an authenticated attacker submits an HTTP request to the vulnerable endpoint targeted at the SystemConfigService.updateSystemConfig method. By manipulating the parameters within the request body, the attacker can supply arbitrary values for system configuration settings. Since the application fails to perform a secondary authorization check at the service level, the backend service processes these malicious parameters and updates the database with the attacker's inputs.\nThe scope of impact is extensive due to the nature of the settings stored in the system configuration. By successfully interacting with this endpoint, an attacker can modify global company identity attributes, change stock and inventory rules, alter workflow approval requirements, or reconfigure printing and reporting templates. These changes can be used to disrupt business operations, facilitate fraudulent activities, or force the application into an insecure state for further exploitation. Because the configuration is tenant-wide, the impact affects all users associated with the target tenant configuration, leading to a compromise of the overall system integrity and business process availability."
}