CVE-2026-94412

Executive Summary

CVE-2026-94412 is an authorization bypass (CWE-862, Missing Authorization) in jshERP through version 3.6, reachable via the POST /user/resetPwd endpoint. Any authenticated user can supply an arbitrary target user ID and reset that account's password to a known default value, granting full unauthorized access to the victim account — including administrator accounts — without any user interaction. With a CVSS v3.1 base score of 8.8, the flaw requires only low-privilege authentication and yields high confidentiality, integrity, and availability impact across the entire deployment.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862), and the vulnerable operation is a state-changing password reset action exposed by the jshERP application. The NVD description states that the flaw resides in the POST /user/resetPwd endpoint, and that an authenticated user can reset any other user's password by submitting a request containing an arbitrary target user ID. Upon processing such a request, the application resets the target account's password to a known default value.

The critical defect is the absence of a server-side authorization check that should verify two things before permitting the operation: (1) that the caller is permitted to perform password resets at all, and (2) that the caller is authorized to reset the password of the specific target account identified in the request. Because jshERP trusts the requester-supplied user identifier and applies the reset without confirming the caller's authority over that identity, the endpoint functions as an unauthenticated-equivalent account takeover primitive for anyone holding any valid low-privilege session.

The attack surface is the application's web tier, exposed over the network (AV:N). The access vector requires only a legitimate authenticated session (PR:L), and no victim participation is needed (UI:N). The scope remains unchanged (S:U) — the vulnerable component and the impacted component are the same application — but the downstream impact on each compromised account is total, reflected in the C:H/I:H/A:H subscores: resetting a password to an attacker-known default allows the attacker to authenticate as the victim, read and modify all data accessible to that identity, and lock the legitimate owner out of their own account. The default reset value is described as "known," meaning the attacker can predict or learn the resulting credential and immediately use it.

The CNA title is empty and the vendor/product fields are recorded as Unknown in the supplied data, so no additional code-level detail (function names, handler classes, parameter names beyond the endpoint itself, or database schema) can be stated with confidence. The description does not identify whether the target user ID is supplied as a query string parameter, form field, or JSON body element; that detail is not available and is not fabricated here. What is derivable is the mechanism: an identity parameter is attacker-controlled and unvalidated against the caller's privileges, and the reset outcome is deterministic and attacker-usable. No public proof-of-concept, Nuclei template, or exploit code has been identified, and no CVE record association with CISA KEV exists.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862) and the endpoint semantics disclosed in the NVD description in conjunction with the CVSS vector and stated impact (arbitrary user password reset to a known default, enabling unauthorized access including administrative accounts). No specific parameter names, payload formats, or internal code paths are invented.

1. Reconnaissance / target identification. The attacker locates an internet- or intranet-exposed jshERP 3.6-or-earlier deployment (see Shodan dorks above). They identify the login interface and confirm the version if the application exposes it. Valid low-privilege credentials must be obtained — through a default account, a separately phished or leased credential, or self-registration if enabled. The attacker enumerates plausible target account identifiers (for example, low sequential or predictable user IDs), which, per the description, are simply referenced by "an arbitrary target user ID."

2. Triggering the flaw. Holding any authenticated session, the attacker sends a POST request to the /user/resetPwd endpoint that names the victim user ID as the target. Because the endpoint performs no authorization check binding the caller to the target identity, the request is accepted and processed.

3. Execution / payload at the class level. The payload is, at minimum, a well-formed authenticated HTTP POST to /user/resetPwd carrying the victim's user identifier. No command injection, memory corruption, or malformed input is required — the vulnerability is purely a missing access-control decision. The server resets the victim's password to the known default value. The attacker does not need to intercept any response beyond confirming the request succeeded.

4. Post-exploitation impact. With the default credential and the victim's user ID, the attacker authenticates as the victim. Targeting an administrator account yields full application control: access to all business data, configuration, and the ability to create or modify other users. Even against non-admin accounts, the attacker gains that identity's data and capabilities, and the password reset causes a denial of service for the legitimate owner, who can no longer log in. Because the reset is a single authenticated request per account, the attacker can repeat the process across many user IDs to take over entire account populations in rapid succession.

Impact Assessment

Business impact is severe and broad. The CVSS v3.1 base score is 8.8 (High), driven by AV:N (exploitable remotely), AC:L (no special conditions), PR:L (requires only a low-privilege session), and UI:N (no victim interaction). The C:H/I:H/A:H subscores indicate complete compromise of confidentiality, integrity, and availability for each targeted account's resources. Because the flaw permits resetting any user's password — explicitly including administrators — the effective blast radius is the entire jshERP instance rather than a single user. Full administrative takeover enables modification of financial/business records, exfiltration of the enterprise resource planning data jshERP manages, persistence via new accounts, and destruction or corruption of records. Availability impact materializes immediately for every reset account, since legitimate users are locked out until an administrator intervenes — and if the administrator account itself is reset first, remediation authority is also lost. There is no evidence of in-the-wild exploitation, CISA KEV listing, or public exploit tooling, so current real-world exploitation risk is driven by the low complexity of the attack and the maturity of jshERP as a self-hosted business application rather than by active campaigns.

Detection Guidance

Sigma Rule

title: jshERP Password Reset of Arbitrary Target User via /user/resetPwd
id: 0a7c5e21-6b3f-4d9a-9e42-7c1f2ab8d904
status: experimental
description: Detects POST requests to the jshERP /user/resetPwd endpoint, indicating possible unauthorized password resets of arbitrary user IDs (CVE-2026-94412).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94412
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|endswith: '/user/resetPwd'
  condition: selection
falsepositives:
  - Legitimate administrative self-service password resets
level: high
tags:
  - attack.t1078
  - attack.persistence
  - cve.2026.94412

YARA Rule

rule CVE_2026_94412_jshERP_ResetPwd_Exploit
{
    meta:
        description = "Detects HTTP request artifacts targeting the jshERP /user/resetPwd authorization bypass (CVE-2026-94412)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94412"
        severity = "high"

    strings:
        $endpoint = "/user/resetPwd" ascii nocase
        $method   = "POST" ascii
        $jsherp   = "jshERP" ascii nocase

    condition:
        $endpoint and $method
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94412 jshERP Unauthorized Password Reset Attempt (POST /user/resetPwd)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/user/resetPwd"; nocase; reference:cve,2026-94412; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94412; classtype:attempted-admin; sid:202694412; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "POST" and http.request.path endsWith "/user/resetPwd" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND like(uri, "%/user/resetPwd%")
| stats count values(uri) as uris values(status) as status_codes by src_ip, user_agent
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,jsherp,cve-2026-94412,">
  <rule id="202694" level="12">
    <if_sid>31100,31108</if_sid>
    <id>^/user/resetPwd</id>
    <match>POST</match>
    <description>CVE-2026-94412: Possible jshERP authorization bypass - POST to /user/resetPwd for arbitrary user password reset</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version advisory, or tracked patch source is available. The following measures do not replace a vendor fix and should be treated as interim.

1. Immediate mitigations:

   • Restrict network access to jshERP management endpoints. Place the application behind a VPN or zero-trust proxy and block POST /user/resetPwd from untrusted networks; permit it only from authenticated administrative networks.
   • Enforce least privilege on jshERP accounts. Because exploitation requires only any authenticated session, eliminate shared, default, or low-privilege accounts that broad populations can hold. Audit for default credentials and self-registration.
   • Apply reverse-proxy access controls. At a WAF or reverse proxy, deny POST to /user/resetPwd unless the caller session is a verified administrative role, and rate-limit or alert on all hits to the endpoint.
   • Monitor for anomalous resets. Alert on any password-reset activity, especially bursts across multiple user IDs or resets targeting high-privilege accounts (see Detection Guidance).
   • If the endpoint is not operationally required, disable it at the proxy layer until a fix is available.

2. Patch/upgrade steps:

   • No fixed version exists in the tracked sources. Monitor the jshERP project's release and advisory channels for a version newer than 3.6 that addresses POST /user/resetPwd authorization.
   • Do not assume version numbers beyond 3.6 are fixed; validate against an official vendor advisory before deployment. If no upstream fix is published, treat the instance as vulnerable and retain compensating controls.

3. Long-term hardening:

   • Implement a mandatory server-side authorization model for every state-changing endpoint, verifying both that the caller may invoke the operation and that the caller may act on the specific target object (object-level authorization / ownership check).
   • Adopt centralized, deny-by-default access control so that new endpoints cannot ship without an explicit authorization rule.
   • Require re-authentication or an out-of-band confirmation for sensitive account operations such as password resets.
   • Integrate authorization checks into code review and automated testing (e.g., broken-access-control test cases) to catch CWE-862 regressions.
   • Continuously inventory and version-track the jshERP deployment and subscribe to vendor and NVD feeds.

References

• NVD — CVE-2026-94412: https://nvd.nist.gov/vuln/detail/CVE-2026-94412
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• FIRST EPSS (no score published for this CVE at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94412 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, vendor advisory, or threat-actor campaign associated with CVE-2026-94412 has been identified in the supplied data.