Jishenghua
Jishenghua Security Releases - October 2026
jishenghua-2026-10 Oct 1, 2026 Source: Vendor
Jishenghua security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-109178
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
12 lines
Showing 1–12 of 12
CVE-2026-109178
BR2026-0000-027047
jshERP
unclaimed
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /lo...
Credited as Yaqi Chao
CVE-2026-109179
BR2026-0000-027048
jshERP
unclaimed
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requ...
Credited as Yaqi Chao
CVE-2026-109180
BR2026-0000-027049
jshERP
unclaimed
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When d...
Credited as Yaqi Chao
CVE-2026-109181
BR2026-0000-027050
jshERP
unclaimed
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus val...
Credited as Yaqi Chao
CVE-2026-109182
BR2026-0000-027051
jshERP
unclaimed
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. ...
Credited as Yaqi Chao
CVE-2026-109183
BR2026-0000-027052
jshERP
unclaimed
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. A...
Credited as Yaqi Chao
CVE-2026-109184
BR2026-0000-027053
jshERP
unclaimed
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attacker...
Credited as Yaqi Chao
CVE-2026-109185
BR2026-0000-027054
jshERP
unclaimed
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attac...
Credited as Yaqi Chao
CVE-2026-109186
BR2026-0000-027055
jshERP
unclaimed
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Atta...
Credited as Yaqi Chao
CVE-2026-109187
BR2026-0000-027056
jshERP
unclaimed
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigCont...
Credited as Yaqi Chao
CVE-2026-109188
BR2026-0000-027057
jshERP
unclaimed
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. A...
Credited as Yaqi Chao
CVE-2026-110615
BR2026-0000-030810
jshERP
unclaimed
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Atta...
Credited as hieuPenguinnn