CVE-2026-94497

Summary

The flaw allows authenticated users to manipulate other users' business objects by bypassing authorization checks, potentially leading to unauthorized data modification or deletion.

Exploitability

Exploitation is relatively easy given that authenticated access is required and direct object identifiers can be used without proper validation.

Blast radius

If exploited, the impact could be significant as it affects multiple resource types and allows for both read and write operations on other users' data.

Prioritized remediation

Update to the latest version of jshERP that addresses this vulnerability or implement custom authorization checks for by-id endpoints.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.