CVE-2026-110615 jishenghua CVE debrief

Who should care

Defenders responsible for jshERP systems, particularly those with version 3.6 or earlier, should assess exposure and prioritize remediation to prevent potential account status manipulation.

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in jshERP systems, particularly those with version 3.6 or earlier, to prevent potential account status manipulation. This requires assessing exposure, implementing proper authorization checks, and monitoring for suspicious activity.

• Potential account lockout of administrators
• Possible re-enabling of disabled accounts
• Unauthorized changes to user account status
• Required verification of jshERP version and exposure

Technical summary

The jshERP system through version 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint. This allows authenticated low-privilege users to change other users' account status, potentially locking out administrators or re-enabling disabled accounts. The vulnerability requires assessing exposure, implementing proper authorization checks, and monitoring for suspicious activity. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in jshERP systems, particularly those with version 3.6 or earlier, to prevent potential account status manipulation.

Recommended defensive actions

• Verify jshERP version and check for exposure
• Restrict access to the /user/batchSetStatus endpoint
• Implement proper authorization checks for user account status changes
• Monitor for suspicious account status changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in jshERP through version 3.6, specifically in the POST /user/batchSetStatus endpoint. This allows authenticated low-privilege users to change other users' account status.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.