CVE-2026-109187: jshERP Information Disclosure Vulnerability

CVE-2026-109187 Overview

CVE-2026-109187 is an information disclosure vulnerability in jshERP through version 3.6. The flaw resides in the getInfoByKey handler of PlatformConfigController, which exposes platform-wide configuration secrets to any authenticated low-privilege user. Attackers can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets. The service only blocks the aliOss and weixin keys, leaving every other configuration entry accessible. The weakness is classified as [CWE-862] Missing Authorization and affects multi-tenant deployments regardless of tenant boundaries.

Critical Impact
Any authenticated user of any tenant can harvest SMTP credentials, activation secrets, and other platform configuration values from jshERP through 3.6, enabling downstream credential abuse and email account takeover.

Affected Products

jshERP through version 3.6
PlatformConfigController component (getInfoByKey endpoint)
PlatformConfigService component (key allow-list logic)

Discovery Timeline

2026-10-12 - CVE-2026-109187 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109187

Vulnerability Analysis

The getInfoByKey endpoint in PlatformConfigController returns the value stored for a caller-supplied platformKey. The handler enforces authentication but omits any role or tenant check before invoking PlatformConfigService. As a result, every authenticated user can retrieve configuration entries intended for administrators.

The service layer attempts to restrict sensitive keys through a static deny list. Only aliOss and weixin are rejected, which leaves high-value entries such as email_auth_code, activation_code, and other secrets reachable. The missing authorization check converts a basic read endpoint into a cross-tenant secret oracle.

Root Cause

The root cause is Missing Authorization [CWE-862] combined with an insufficient deny-by-default policy. The controller treats configuration reads as low-sensitivity data and defers filtering to a hard-coded block list in the service. Any new sensitive key added to the configuration store is exposed by default until the deny list is updated. See the PlatformConfigController source and PlatformConfigService source for the exact logic.

Attack Vector

An attacker authenticates to jshERP with any valid low-privilege account, including an account belonging to a different tenant. The attacker issues a GET request to the getInfoByKey endpoint and supplies a target platformKey such as email_auth_code. The server returns the plaintext value. Enumeration of known key names yields SMTP credentials usable for sending phishing from the platform's own mail account, along with activation secrets that may enable further abuse of licensing or onboarding flows. A public proof-of-concept script is available at the GitHub PoC repository.

Detection Methods for CVE-2026-109187

Indicators of Compromise

Repeated HTTP requests to the platformConfig/getInfoByKey endpoint from a single authenticated session, especially with varied platformKey parameters.
Requests containing platformKey values such as email_auth_code, activation_code, or other non-public keys from non-administrator accounts.
Outbound SMTP connections or mail sent from the jshERP service account to unexpected recipients, indicating credential reuse after disclosure.

Detection Strategies

Enable verbose access logging on the PlatformConfigController and alert on getInfoByKey calls originating from accounts without administrative roles.
Baseline normal usage of getInfoByKey and flag sessions that enumerate more than a small number of distinct platformKey values within a short window.
Correlate authentication logs with configuration-read events to identify cross-tenant access to platform secrets.

Monitoring Recommendations

Forward jshERP application logs to a centralized logging or SIEM platform and build a saved query for getInfoByKey access patterns.
Monitor the mailbox tied to email_auth_code for unexpected sign-ins or outbound bulk mail that could indicate credential abuse.
Track changes to the deny list in PlatformConfigService so any newly added keys are reviewed for sensitivity.

How to Mitigate CVE-2026-109187

Immediate Actions Required

Restrict network access to the jshERP management interfaces to trusted administrators until a patched release is deployed.
Rotate every secret stored in platformConfig, including SMTP authorization codes, activation codes, and any API tokens that may have been read.
Review authentication logs for low-privilege accounts that accessed getInfoByKey and disable suspicious accounts.

Patch Information

No official vendor patch has been published in the enriched CVE data at the time of writing. Monitor the VulnCheck advisory and the upstream jshERP repository for updated releases beyond version 3.6 that enforce role-based access control on PlatformConfigController.

Workarounds

Apply a local source modification that enforces an administrator role check at the top of the getInfoByKey handler in PlatformConfigController.
Replace the hard-coded block list in PlatformConfigService with a deny-by-default allow list that only exposes keys explicitly safe for non-administrators.
Place a reverse proxy or Web Application Firewall (WAF) rule in front of jshERP that blocks requests to platformConfig/getInfoByKey from sessions lacking an administrator role claim.

bash

# Example WAF rule concept to block non-admin access to the vulnerable endpoint
# Pseudocode - adapt to your WAF syntax
if request.path matches "/jshERP-boot/platformConfig/getInfoByKey" \
   and session.role != "admin":
    deny with 403