Vulnerability · Published Sep 21, 2026 · Assigned by VulnCheck
CVE-2026-94494jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
Medium 5.0
In plain English
A medium-severity authorization bypass via user-controlled key in jshERP from jishenghua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.4%top 69.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jishenghua | jshERP | 0 – through 3.6 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- Proof of concept exploit
- Vulnerable code technical-description
- https://github.com/jishenghua/jshERP product
- VulnCheck Advisory: jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info third-party-advisory