CVE-2026-109186 | jishenghua jshERP up to 3.6 UserController /user/update UserController.update tenant_id/password dynamically-determined object attributes

October 12, 2026 Yanac

A vulnerability classified as critical was found in jishenghua jshERP up to 3.6. This impacts the function UserController.update of the file /user/update of the component UserController. Executing a manipulation of the argument tenant_id/password can lead to dynamically-determined object attributes.

This vulnerability is registered as CVE-2026-109186. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More