CVE-2026-94412: Jishenghua Jsherp

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.

Affected products

• Jishenghua Jsherp: up to and including 3.6

Published 2026-09-21. Last modified 2026-09-22.