CVE-2026-94495

Summary

The flaw allows authenticated users to modify tenant system configurations, potentially leading to unauthorized changes in company identity, stock rules, approval behavior, and printing settings.

Exploitability

Exploitation requires authentication but no specific user privileges are needed beyond basic access, making it relatively easy for malicious insiders or compromised accounts.

Blast radius

If exploited, the impact could be significant as it affects tenant-wide settings critical to business operations, potentially leading to operational disruptions and data integrity issues.

Prioritized remediation

Update jshERP to version 3.7 or later which addresses this vulnerability according to the vendor.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.