CVE-2026-94495

HighCVSS 7.1/10Last modified Sep 24, 2026

Description

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-944968.3jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data CVE-2026-944978.3jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authentica CVE-2026-944986.5Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-944997.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94506.3A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.ph CVE-2026-945006.5Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.CVE-2026-945018.8jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to crea CVE-2026-945027.5In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote CVE-2026-9450310.0Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue CVE-2026-945047.2Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An CVE-2026-945058.1The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all version CVE-2026-945066.5Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.