CVE-2026-94494

Summary

This vulnerability allows authenticated users to read other tenants' records by exploiting a tenant isolation bypass in jshERP through version 3.6, potentially exposing sensitive data.

Exploitability

Exploitation requires authentication and knowledge of the target tenant's primary key; enumeration of all tenants' data is feasible but may require significant effort.

Blast radius

If exploited, this could lead to unauthorized access to sensitive tenant information across multiple platform instances, impacting privacy and security significantly.

Prioritized remediation

Upgrade jshERP to version 3.7 or later, which addresses the vulnerability according to the vendor.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.