CVE-2026-109184: jshERP Authorization Bypass Vulnerability

CVE-2026-109184 Overview

CVE-2026-109184 is an improper authorization vulnerability [CWE-862] in jshERP through version 3.6. The flaw resides in the GET /account/findAccountInOutList endpoint of the Account controller. Low-privilege authenticated users can supply an arbitrary accountId parameter and retrieve settlement account ledgers they are not entitled to view. The server fails to enforce the caller's data scope, which should restrict results to personal or departmental records within the tenant. Successful exploitation discloses bill numbers, counterparties, transaction amounts, and remarks belonging to other users. The issue was published to the National Vulnerability Database (NVD) on 2026-10-12.

Critical Impact
Any authenticated tenant user can enumerate financial ledgers across the organization, exposing counterparty relationships and transaction amounts.

Affected Products

jshERP through version 3.6
AccountController.findAccountInOutList endpoint
Deployments relying on jshERP data-scope filtering for financial records

Discovery Timeline

2026-10-12 - CVE-2026-109184 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109184

Vulnerability Analysis

The vulnerability is a broken access control defect in jshERP's financial module. The findAccountInOutList handler accepts an accountId query parameter and returns the inbound and outbound transaction history for that account. jshERP implements a role-based data scope model that is meant to restrict users to records tied to their own identity or department. For this endpoint, the scope check is not applied before the database query executes. As a result, an authenticated user whose role is limited to personal or department-level data can request records for any account identifier that exists in the tenant. The exposed fields include bill numbers, counterparty names, amounts, and free-text remarks, which can reveal commercial relationships and payment flows.

Root Cause

The underlying cause is missing authorization enforcement in the controller and mapper layer. The AccountController passes the user-supplied accountId directly into the MyBatis mapper defined in AccountMapperEx.xml without filtering by the caller's assigned data scope. The mapper SQL selects ledger rows based solely on tenant and accountId, so the server treats any authenticated session as sufficient authorization. The defect maps to CWE-862: Missing Authorization.

Attack Vector

Exploitation requires only a valid low-privilege session on the target jshERP tenant. The attacker iterates numeric accountId values and issues GET /account/findAccountInOutList requests, parsing the JSON response for ledger entries. No elevated role, user interaction, or additional authentication is needed. See the VulnCheck Advisory on jshERP and the published GitHub PoC Script for request structure and response parsing.

No verified exploit code is reproduced here. Refer to the GitHub Account Controller Code and the GitHub Account Mapper XML for the vulnerable code paths.

Detection Methods for CVE-2026-109184

Indicators of Compromise

Repeated GET /account/findAccountInOutList requests from a single session that enumerate sequential or varied accountId values.
Response payloads returning ledger entries for accounts not owned by the requesting user's department.
Spikes in AccountController traffic from non-finance roles during off-hours.

Detection Strategies

Enable verbose application logging on jshERP controllers and correlate accountId parameters with the authenticated user's role and department.
Deploy a web application firewall (WAF) rule that flags high-cardinality accountId enumeration against the /account/findAccountInOutList path.
Review access logs for user accounts that query the endpoint but have no business justification to view financial ledgers.

Monitoring Recommendations

Baseline normal usage of the finance endpoints per role and alert on deviations in request volume or unique accountId counts.
Forward jshERP application and reverse-proxy logs to a central analytics platform for cross-session correlation.
Monitor outbound data volume from the jshERP host for anomalous spikes consistent with bulk ledger extraction.

How to Mitigate CVE-2026-109184

Immediate Actions Required

Restrict network exposure of jshERP to trusted users and apply an authenticated-only reverse proxy policy.
Audit role assignments and remove unnecessary access to finance modules for non-finance personnel.
Review recent access logs for the /account/findAccountInOutList endpoint and investigate anomalous accountId enumeration.

Patch Information

As of the NVD publication date, no vendor-released patched version is referenced in the advisory. Track the upstream jishenghua/jshERP repository and the VulnCheck Advisory on jshERP for a fixed release. Any patch should add a data-scope check in AccountController.findAccountInOutList and in the corresponding mapper SQL in AccountMapperEx.xml.

Workarounds

Add a reverse-proxy or API gateway rule that blocks requests to /account/findAccountInOutList from roles that do not require financial ledger access.
Modify AccountMapperEx.xml to constrain queries by the caller's userId or departmentId in addition to accountId.
Temporarily disable the account in/out list feature in deployments where it is not operationally required.

bash

# Example reverse-proxy restriction (nginx)
location /account/findAccountInOutList {
    # Allow only finance subnet; deny all others
    allow 10.10.20.0/24;
    deny all;
    proxy_pass http://jsherp_backend;
}