CVE-2026-94412

Summary

The vulnerability allows authenticated users to reset any other user's password, granting unauthorized access. This can lead to significant data breaches and loss of control over administrative accounts.

Exploitability

Exploitation requires an authenticated session but no specific knowledge of target credentials, making it moderately easy for attackers with access.

Blast radius

If exploited, this vulnerability could result in widespread unauthorized access across the system, potentially compromising all user accounts including administrators.

Prioritized remediation

Update to the latest version of jshERP that addresses this vulnerability or disable the affected endpoint.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.