jshERP: Mass assignment in user update endpoint allows account takeover
Summary
jshERP through 3.6 contains a mass assignment flaw in the user update endpoint PUT /user/update. An authenticated user with any low-privilege account can overwrite protected fields such as tenant_id and password. This allows switching into another tenant or taking over other accounts by setting new password hashes.
Affected
- jishenghua jshERP 0 through 3.6 (according to the CVE record)
Fixed in
Unknown. No vendor advisory or patched release has been identified.
Workaround
- No vendor-confirmed workaround.
- Restrict network access to the jshERP application.
- Limit or disable self-registration and remove unneeded accounts.
- Review tenant assignments and password changes for anomalies.
Exploitation
- A public proof of concept is available (VulnCheck lists a researcher PoC).
- Not listed in CISA KEV; no confirmed in-the-wild exploitation found.
- EPSS below 1 percent (OpenCVE).
Our recommendation
- Identify all jshERP instances and their versions.
- Restrict exposure to the internet and shared multi-tenant use until a fix is confirmed.
- Limit account creation and review existing accounts and tenant assignments.
- Monitor for unexpected password changes and tenant switches.
- Check the vendor repository and NVD for a fixed release and apply it when available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- jshERP UserController.java (vulnerable code) github.com
- jshERP UserService.java (vulnerable code) github.com
- OSV record CVE-2026-109186 osv.dev
- OpenCVE CVE-2026-109186 app.opencve.io
- jshERP issue 165 (multi-tenant registration) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:56.
Original description (NVD)
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
NVD references (4)
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identi…
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/…
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/…
- https://www.vulncheck.com/advisories/jsherp-through-3.6-mass-assignment-via-put-user-update
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.