CVE-2026-94412
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
- Published Sep 21, 2026
- CVSS 8.7 high
- 0.5% chance of exploitation in the next 30 days (EPSS)