CVE-2026-109186

Published: Ott 12, 2026 Last Modified: Ott 12, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,7

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

HIGH 8,8

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

Description

AI Translation Available

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.

915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Incomplete

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Other

Potential Impacts:

Modify Application Data Execute Unauthorized Code Or Commands Varies By Context Alter Execution Logic

Applicable Platforms

Languages: Ruby, ASP.NET, PHP, Python, Not Language-Specific

View CWE Details

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d142…

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d…

https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de…

https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a…