CVE-2026-109186: jshERP Mass Assignment Auth Bypass

CVE-2026-109186 Overview

CVE-2026-109186 is a mass assignment vulnerability [CWE-915] in jshERP through version 3.6. The flaw resides in the UserController update handler, which binds request parameters directly to the user entity without field whitelisting. Authenticated users can send a crafted PUT /user/update request that overwrites protected fields including tenant_id and password. Successful exploitation allows an attacker to migrate their account into another tenant on next login or overwrite other users' password hashes for full account takeover.

Critical Impact

Any authenticated jshERP user can escalate privileges across tenant boundaries or hijack arbitrary accounts by overwriting password hashes through a single PUT /user/update request.

Affected Products

• jshERP through version 3.6
• jshERP-boot backend component (UserController, UserService)
• Deployments running the vulnerable PUT /user/update endpoint

Discovery Timeline

• 2026-10-12 - CVE-2026-109186 published to NVD
• 2026-10-12 - Last updated in NVD database

Technical Details for CVE-2026-109186

Vulnerability Analysis

The vulnerability is a classic mass assignment flaw in a Spring-based Java ERP application. The UserController.updateUser handler accepts a JSON body and binds it directly to the User persistence object before calling UserService.updateUser. No field-level allowlist filters sensitive attributes such as tenant_id, password, or role identifiers.

An authenticated attacker with the lowest privilege level can submit arbitrary field assignments in the update payload. The service layer persists those fields verbatim through MyBatis. Overwriting tenant_id effectively re-parents the attacker's account into a victim tenant, bypassing tenant isolation on the next authenticated session. Overwriting password with a precomputed hash of a known value enables full account takeover of any user whose id the attacker references.

The root issue is architectural: the controller trusts client-supplied fields on a model that includes security-sensitive columns. Review the referenced UserController source and UserService source for the exact binding and persistence paths.

Root Cause

The UserController update handler performs object-level data binding without a Data Transfer Object (DTO) layer or @JsonIgnore annotations on protected fields. All attributes of the User entity are writable from untrusted input, violating the principle of least privilege for data binding.

Attack Vector

Exploitation requires a valid session on the target jshERP instance. The attacker issues a PUT /user/update request containing additional JSON keys such as tenantId or password. The vulnerability is reachable over the network at low attack complexity. See the public proof-of-concept and the VulnCheck advisory for exploitation details.

Detection Methods for CVE-2026-109186

Indicators of Compromise

• PUT /user/update requests containing tenantId, tenant_id, password, or role-related fields in the JSON body
• Unexpected changes to the tenant_id column on existing user rows in the jshERP database
• Users successfully authenticating into tenants they were not originally provisioned for
• Password hash values changing for accounts without a corresponding password-reset workflow event

Detection Strategies

• Deploy a Web Application Firewall (WAF) rule that inspects PUT /user/update bodies and blocks requests containing fields outside the expected allowlist
• Enable application-level audit logging of all user profile updates, capturing the full set of modified columns
• Compare pre- and post-update values of tenant_id and password columns and alert on changes outside administrative workflows

Monitoring Recommendations

• Baseline normal PUT /user/update payload keys and alert on new or sensitive field names appearing in request bodies
• Correlate successful authentications with recent profile updates to detect cross-tenant login anomalies
• Monitor for a single session issuing update requests referencing multiple distinct user id values

How to Mitigate CVE-2026-109186

Immediate Actions Required

• Restrict network access to the jshERP management interface until a patch is applied
• Rotate all user passwords and invalidate active sessions if exploitation is suspected
• Audit the user table for unauthorized changes to tenant_id, password, and role fields
• Review authentication logs for logins from accounts into unexpected tenants

Patch Information

As of the NVD publication date (2026-10-12), no fixed version is listed for jshERP. Monitor the upstream jshERP repository and the VulnCheck advisory for an official fix. Operators compiling from source should introduce a dedicated DTO for the update endpoint that only exposes user-editable attributes, and reject or ignore any additional fields on the server side.

Workarounds

• Place the PUT /user/update endpoint behind a reverse-proxy rule that strips tenantId, tenant_id, password, and role fields from inbound JSON bodies
• Apply a local source patch to annotate sensitive fields on the User entity with @JsonIgnore or introduce a UserUpdateDTO with an explicit allowlist
• Enforce server-side authorization checks so a user can only update their own id and only non-privileged fields
• Disable self-service profile updates for low-privilege roles until an upstream fix is available

# Example nginx snippet to block sensitive keys in PUT /user/update bodies
location = /user/update {
    if ($request_method = PUT) {
        set $block 0;
        if ($request_body ~* "\"(tenant_?id|password|roleId)\"\s*:") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://jsherp_backend;
}