CVE-2026-94413: jshERP Information Disclosure Vulnerability

CVE-2026-94413 Overview

CVE-2026-94413 is an information disclosure vulnerability in jshERP through version 3.6, an open-source enterprise resource planning application. The /user/info endpoint returns full user records without stripping the password field, exposing unsalted MD5 password digests to any authenticated caller. Attackers can iterate user IDs to harvest hashes for every account in the system, including administrators. Because the hashes are unsalted MD5, adversaries can crack them offline using rainbow tables or reuse them directly against endpoints that accept pre-hashed credentials. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated jshERP user can retrieve MD5 password hashes for arbitrary accounts, enabling offline cracking and full authentication bypass across the ERP deployment.

Affected Products

jshERP versions up to and including 3.6
jshERP-boot backend component (UserController.java)
Deployments exposing the /user/info REST endpoint

Discovery Timeline

2026-09-21 - CVE-2026-94413 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94413

Vulnerability Analysis

The vulnerability resides in the UserController class of the jshERP-boot backend, specifically in the handler serving the /user/info endpoint. The controller retrieves a User entity by ID and serializes the entire object into the JSON response without removing sensitive fields. The password attribute, stored as an unsalted MD5 digest, is included verbatim in the response body.

Authenticated attackers only require a valid session token to query the endpoint. By enumerating user IDs, an attacker can build a complete inventory of account identifiers and their corresponding password hashes. Unsalted MD5 offers negligible resistance to modern cracking hardware, and common passwords resolve instantly against precomputed rainbow tables. See the VulnCheck Security Advisory for full technical analysis.

Root Cause

The root cause is the absence of a data transfer object (DTO) or response filter that redacts security-sensitive fields before serialization. The controller returns the persistence-layer User entity directly, exposing internal columns that were never intended for client consumption. See the vulnerable code region in the UserController source.

Attack Vector

Exploitation requires network access to the ERP application and a low-privilege authenticated session. The attacker issues an HTTP GET request to /user/info supplying arbitrary user IDs as parameters. The server responds with the target user's JSON record, including the password field containing the raw MD5 hash. The attacker cracks the hash offline or replays it against systems that trust MD5-hashed credentials. A working proof of concept is available in the GitHub PoC repository.

Detection Methods for CVE-2026-94413

Indicators of Compromise

Repeated authenticated requests to /user/info with sequential or enumerated id parameters from a single session or source IP.
Response payloads from /user/info containing a password field with a 32-character hexadecimal value.
Successful logins from geographies or devices inconsistent with a user's baseline, following prior /user/info reconnaissance.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect /user/info responses and alert when the password key is present in the JSON body.
Correlate access logs to identify accounts querying /user/info for multiple distinct user IDs in short time windows.
Enable audit logging on the jshERP application server to record every invocation of the user information endpoint with caller identity.

Monitoring Recommendations

Ingest jshERP application and reverse-proxy logs into a centralized analytics platform to flag enumeration patterns.
Monitor authentication events for anomalous password reuse across previously dormant accounts.
Track outbound traffic from the ERP host for exfiltration bursts that follow bulk /user/info queries.

How to Mitigate CVE-2026-94413

Immediate Actions Required

Restrict network exposure of the jshERP application to trusted internal networks or VPN users only.
Force a password reset for every jshERP account and invalidate active sessions.
Block or rate-limit access to /user/info at a reverse proxy until a patched build is deployed.

Patch Information

As of the NVD publication date, no vendor-issued patch is referenced for jshERP versions through 3.6. Monitor the jshERP GitHub repository for a fixed release and review the VulnCheck advisory for remediation updates. Organizations maintaining internal forks should modify UserController to return a DTO that omits the password field and migrate stored credentials to a salted, adaptive hash such as bcrypt or Argon2.

Workarounds

Introduce a reverse-proxy rule that strips the password field from JSON responses served by /user/info.
Apply a source-code patch to the controller to nullify the password attribute before returning the User object.
Enforce least-privilege role assignments so that only administrative accounts can query other users' records.

bash

# Nginx configuration example: deny direct client access to /user/info
location = /user/info {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://jsherp_backend;
}