A critical authorization bypass in jshERP 3.6 and earlier allows authenticated users to perform unauthorized read, update, and delete operations on business data belonging to other tenants.

The application fails to perform authorization checks when processing requests to info, update, and delete endpoints. By manipulating direct object identifiers, any authenticated user can interact with objects they do not own, bypassing cross-tenant data isolation.

The ability for low-privileged users to modify or delete sensitive business records poses a severe risk to data integrity and operational continuity. Given the CVSS score of 8.3, this high-severity flaw could lead to the unauthorized exposure of proprietary information, financial data corruption, or the permanent loss of business records.

Immediate Action: Update to the latest version of jshERP as provided by the vendor to resolve the missing authorization checks. If an update is not immediately available, restrict access to the application to trusted users only.

Proactive Monitoring: Review application access logs for anomalous patterns, such as a single user account requesting or modifying a high volume of sequential object IDs, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block requests that attempt to access restricted API endpoints or manipulate object identifiers in an unauthorized manner.

Public Exploit Available: Yes — a functional proof-of-concept script has been published on GitHub.

This vulnerability represents a significant risk to organizational data security due to the ease with which attackers can manipulate business objects. Administrators should prioritize patching their jshERP instances immediately to prevent unauthorized data tampering and ensure that proper authorization logic is enforced across all API endpoints.