Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109187jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey

Medium 6.5

In plain English

A medium-severity missing authorization in jshERP from jishenghua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.

Affected products (as reported)

Vendor	Product	Versions
jishenghua	jshERP	0 – through 3.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (3.6) technical-description
Vulnerable Code (3.6) technical-description
VulnCheck Advisory: jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey third-party-advisory