CVE-2026-94494: jshERP Tenant Isolation Bypass Vulnerability

CVE-2026-94494 Overview

CVE-2026-94494 is a tenant isolation bypass in jshERP through version 3.6. The GET /tenant/info endpoint fails to enforce authorization checks that scope results to the requesting user's tenant. Authenticated users can iterate the primary key parameter to enumerate records belonging to other tenants on the platform. Exposed fields include tenant login names, validity dates, user quotas, and enabled state. The flaw is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated jshERP user can enumerate sensitive metadata for every tenant on a shared deployment by incrementing an integer identifier against /tenant/info.

Affected Products

jshERP through version 3.6
jshERP-boot component (TenantController.java)
Multi-tenant jshERP deployments exposing the /tenant/info endpoint

Discovery Timeline

2026-09-21 - CVE-2026-94494 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94494

Vulnerability Analysis

jshERP is an open-source enterprise resource planning platform that supports multi-tenant deployments. The TenantController exposes an information endpoint that accepts a tenant identifier as a query parameter. The handler retrieves the corresponding row directly from the tenant table without verifying that the requesting session belongs to the referenced tenant.

Any authenticated account, including low-privileged users, can query /tenant/info with an arbitrary primary key. The server returns tenant metadata including loginName, validity dates, userNumLimit, and the enabled flag. An attacker can script sequential lookups from id=1 upward to build a complete inventory of tenants hosted on the target instance.

The disclosed data supports follow-on attacks. Login names feed credential-stuffing and password-spray campaigns. Validity dates and enabled state identify tenants approaching expiration or already disabled, which are useful targets for account takeover and social engineering.

Root Cause

The root cause is missing object-level authorization in TenantController.java at lines 36–48 of the v3.6 branch. The controller trusts the client-supplied identifier and performs a direct database lookup. It never compares the requested tenant identifier against the tenant scope bound to the authenticated session token.

Attack Vector

Exploitation requires only a valid low-privilege session and network access to the jshERP web interface. The attacker issues successive GET /tenant/info?id=N requests, incrementing N to walk the primary key space. Each response yields another tenant record. A proof of concept is published in the LinYuanyi1 cve-request-poc repository. Refer to the VulnCheck advisory for full technical context.

Detection Methods for CVE-2026-94494

Indicators of Compromise

Sequential or high-volume GET /tenant/info requests from a single authenticated session iterating the id parameter.
Requests to /tenant/info where the supplied tenant identifier does not match the tenant bound to the session's JWT or cookie.
Application logs showing successful 200 OK responses to /tenant/info queries spanning multiple tenant identifiers within a short window.

Detection Strategies

Correlate authenticated user sessions with the tenant identifiers they query, and alert when the ratio of distinct identifiers to requests exceeds a baseline threshold.
Deploy web application firewall (WAF) rules that flag primary key enumeration patterns against /tenant/info.
Enable verbose audit logging in jshERP for the TenantController and forward events to a centralized SIEM for query pattern analysis.

Monitoring Recommendations

Ingest jshERP application and reverse-proxy logs into a security data lake and build queries that surface cross-tenant reads.
Monitor egress from the jshERP host for bulk exports of tenant metadata to unfamiliar destinations.
Track authentication anomalies against tenant loginName values that were previously queried through /tenant/info.

How to Mitigate CVE-2026-94494

Immediate Actions Required

Restrict network access to the jshERP /tenant/info endpoint using an upstream reverse proxy or WAF until an authorization fix is applied.
Audit access logs for prior enumeration of /tenant/info and rotate credentials for any tenants whose loginName values were disclosed.
Enforce short session lifetimes and require multi-factor authentication for all jshERP accounts to limit follow-on abuse.

Patch Information

As of publication, no vendor patch is referenced in the NVD entry. Track the jshERP GitHub repository for updates addressing the TenantController authorization gap. Deployments running version 3.6 or earlier remain exposed.

Workarounds

Apply a server-side authorization filter in TenantController.java that validates the requested tenant identifier against the session's tenant claim before returning data.
Block or rate-limit the /tenant/info route at the reverse proxy for non-administrative roles.
Segment multi-tenant deployments so that each tenant runs on an isolated jshERP instance, eliminating shared primary key exposure.

bash

# Example nginx rule to block /tenant/info from non-admin networks
location = /tenant/info {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://jsherp_backend;
}