CyberRota Analysis
AI-GeneratedThe vulnerability in jshERP versions up to 3.6 allows authenticated users to bypass authorization checks, enabling them to read, modify, and delete other users' business objects through direct object identifiers. This lack of proper object ownership validation poses a significant risk to data integrity and confidentiality. Organizations using jshERP should prioritize remediation to prevent unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.