CVE-2026-109186

Summary

The jshERP application has a mass assignment vulnerability in its user management system that allows authenticated users to overwrite critical fields like tenant_id and password hashes. This flaw enables attackers to impersonate other users or gain unauthorized access to accounts.

Exploitability

Exploitation requires an authenticated user account and is relatively straightforward, involving sending a crafted PUT request to the /user/update endpoint with specially constructed parameters to override protected fields.

Blast radius

If exploited, this vulnerability could allow attackers to takeover multiple user accounts across different tenants, potentially leading to widespread unauthorized access to business data and operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected UserController update handler or implement strict field whitelisting for all mass assignment operations in the user management module until a proper patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.