CVE-2026-94494: jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-09-22
Weakness: CWE-639

Description

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

Affected products

jishenghua jshERP: through 3.6

References

https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-09-tenant-cross-tenant-read.py
https://github.com/jishenghua/jshERP
https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/TenantController.java#L36-L48
https://www.vulncheck.com/advisories/jsherp-through-3.6-tenant-information-disclosure-via-get-tenant-info

Get alerted when CVE-2026-94494 or the next vulnerability affects your stack