CVE-2026-94497

Executive Summary

CVE-2026-94497 is a broken object-level authorization (IDOR) vulnerability in jshERP through version 3.6, affecting by-id information, update, and delete endpoints across multiple resource types. The flaw stems from the application's failure to verify that a requesting authenticated user owns or is authorized to access the business object referenced by the supplied identifier (CWE-639). Any authenticated user — regardless of role or tenant scope — can read, modify, or delete other users' business objects by submitting direct object identifiers, resulting in cross-tenant data exposure, data integrity loss, and destructive deletion of records with a CVSS base score of 8.3 (High).

Technical Analysis

jshERP is an open-source enterprise resource planning (ERP) platform widely deployed for inventory, accounting, purchasing, sales, and warehouse management. The vulnerability class is Insecure Direct Object Reference / broken object-level authorization (IDOR / BOLA), mapped to CWE-639 ("Authorization Bypass Through User-Controlled Key").

The core defect, as described, is that the application fails to validate object ownership in "by-id info, update, and delete endpoints across multiple resource types." In practical terms, a controller receives a user-supplied object identifier and retrieves, mutates, or removes the referenced record based solely on that identifier — without performing a server-side ownership or authorization check against the authenticated session's user or tenant context. Because the object identifier is directly user-controllable, an attacker can substitute identifiers belonging to other users.

The authorization model defect is architectural rather than a single-endpoint slip: the NVD description explicitly notes that the failure spans "multiple resource types" and three operation classes (info/read, update, delete). This indicates a systemic absence of object-level access control enforcement across the application's data-access layer — likely a recurring pattern in which endpoints trust the client-supplied identifier as sufficient authorization proof.

Authentication is required (the attacker must hold valid low-privilege credentials), and the attack is network-reachable with no user interaction, per the CVSS vector AV:N/AC:L/PR:L/UI:N. The confidentiality and integrity impacts are High, while availability impact is Low, consistent with read/update operations being fully exposed and delete operations affecting individual records rather than systemic availability. No public proof-of-concept, exploit code, or Nuclei template is available, and the EPSS score is not yet assigned by FIRST.org. No affected-version package data or OSV entries were provided; scope is bounded by the description to "through 3.6."

No specific endpoint paths, parameter names, function names, or class names are provided in the source data, so this analysis deliberately remains at the vulnerability-class level rather than fabricating implementation specifics.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-639) and the NVD description provided.

1. Reconnaissance / target identification. The attacker identifies a reachable jshERP instance (version ≤ 3.6) through internet-facing exposure. Using valid low-privilege credentials (obtained legitimately, via credential reuse, or from prior compromise), the attacker authenticates to establish a session. Because the vulnerability requires only PR:L, any standard user account is sufficient.

2. Triggering the flaw class. The attacker interacts with by-id info, update, or delete operations across the multiple resource types referenced in the description. By modifying the object identifier supplied in the request to a value belonging to a different user or tenant, the attacker directs the server to act on a record they do not own. The server, per the defect, does not validate ownership before processing the request, so the operation succeeds.

3. Payload / execution method (class level). Eschewing any invented parameter or endpoint names, the exploitation primitive is identifier substitution on user-controlled object references: the same request structure used for legitimate access is replayed with a foreign identifier. No injection or code-execution payload is required — the flaw is authorization logic, so the "payload" is simply an unauthorized identifier value.

4. Post-exploitation impact. Successful exploitation yields read access to other users' business objects (confidentiality breach — e.g., financial, customer, or inventory data), unauthorized modification of those objects (integrity breach), and deletion of arbitrary target records (destructive impact). An attacker can enumerate identifiers to harvest or sabotage large volumes of business data, undermining tenant isolation and data integrity across the ERP dataset.

Impact Assessment

The CVSS 3.1 base score is 8.3 (High), derived from AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The scope is Unchanged, meaning impact is confined to the jshERP application's security authority, but within that boundary the confidentiality and integrity impacts are High. A low-privileged authenticated user can cross authorization boundaries to read and modify data they should never access, and can issue deletes that permanently destroy records (availability impact Low reflects per-record rather than service-wide disruption).

Business impact includes: exposure of sensitive business objects (financial records, customer and supplier data, inventory and order information) across user/tenant boundaries; corruption or tampering of ERP records that propagate into downstream accounting, reporting, and fulfillment workflows; and irreversible deletion of business-critical data leading to operational disruption and compliance exposure. Because authorization failures span multiple resource types, the blast radius covers a broad swath of the application's data model rather than a single module. Any organization exposing jshERP ≤ 3.6 to authenticated users — especially multi-tenant or multi-department deployments — is affected. The absence of a CISA KEV listing and public exploit lowers the current observed-threat baseline, but the trivial exploitation primitives (valid account + identifier substitution) make this attractive for insider threats and post-compromise lateral data theft.

Detection Guidance

Sigma Rule

title: Potential jshERP IDOR - Mass Sequential Object Identifier Access
id: 7c9f2a41-3b6e-4d18-9a2c-jshERP94497
status: experimental
description: Detects rapid sequential or out-of-range object identifier access against jshERP by-id info/update/delete endpoints, indicative of IDOR (CVE-2026-94497) enumeration.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94497
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
  selection_app:
    cs-uri-stem|contains: 'jshERP'
  selection_id_param:
    cs-uri-query|re: '(?i)(id|Id|ID)=\d+'
  timeframe: 5m
  condition: selection_app and selection_method and selection_id_param | count() by src_ip > 50
fields:
  - src_ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate bulk operations by administrative users
  - Scheduled integrations iterating over records
level: medium
tags:
  - attack.t1078
  - attack.t1190
  - cve.2026.94497

YARA Rule

rule CVE_2026_94497_jshERP_IDOR_Exploitation
{
    meta:
        description = "Detects HTTP request artifacts indicative of jshERP IDOR exploitation (CVE-2026-94497) in web logs or capture files"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94497"
        date = "2026-01-01"
        severity = "high"

    strings:
        $app = "jshERP" ascii nocase
        $id1 = "id=" ascii nocase
        $m1 = "DELETE " ascii
        $m2 = "PUT " ascii
        $p1 = "/info" ascii nocase
        $p2 = "/update" ascii nocase
        $p3 = "/delete" ascii nocase

    condition:
        $app and $id1 and 2 of ($m1, $m2, $p1, $p2, $p3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94497 jshERP IDOR Attempt - by-id access/update/delete"; flow:established,to_server; http.uri; content:"jshERP"; nocase; http.uri; pcre:"/(info|update|delete)/i"; http.uri; pcre:"/[?&](id|Id|ID)=\d+/"; classtype:attempted-user; reference:cve,2026-94497; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94497; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202694497; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [http where http.request.method in ("PUT", "POST", "DELETE") and
   url.path like "*jshERP*" and
   url.query rlike ".*(?i)(id|Id|ID)=\\d+.*"]
  [http where http.request.method in ("PUT", "POST", "DELETE") and
   url.path like "*jshERP*" and
   url.query rlike ".*(?i)(id|Id|ID)=\\d+.*" and
   http.response.status_code in (200, 204)]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)jshERP")
| where match(uri_query, "(?i)(id|Id|ID)=\d+")
| eval target_id = replace(uri_query, ".*(?i)(id|Id|ID)=(\d+).*", "\1")
| stats count values(uri_path) as paths values(target_id) as ids dc(target_id) as unique_ids by src_ip, user
| where unique_ids > 20 OR count > 100
| sort - unique_ids

Wazuh OSSEC Rule

<group name="web,jshERP,idor,">
  <rule id="100497" level="10">
    <if_sid>31100</if_sid>
    <url>jshERP</url>
    <url>(?i)(info|update|delete)</url>
    <regex>(?i)(id|Id|ID)=\d+</regex>
    <description>CVE-2026-94497: Potential jshERP IDOR exploitation - by-id info/update/delete access attempt</description>
    <mitre>
      <id>T1078</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94497,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence available from any tracked source).

1. Immediate mitigations (no vendor patch available):

   • Restrict network exposure of jshERP instances to trusted networks/VPN; do not expose the application directly to the internet.
   • Enforce least privilege: audit and minimize the number of authenticated accounts, decommission stale accounts, and disable any users without a business need.
   • At the reverse-proxy/WAF layer, apply rate limiting and anomaly detection on by-id info/update/delete request patterns to disrupt enumeration.
   • Where feasible, deploy a compensating authorization proxy or middleware that validates object ownership against the session identity before requests reach the application, if the architecture permits interception of the affected operations.
   • Increase application and database logging/auditing of read/update/delete operations to support rapid detection and forensic response.

2. Patch / upgrade steps:

   • No vendor fix is available as of this assessment. Monitor the jshERP project's official release channels and advisory feeds for a version beyond 3.6 that remediates CVE-2026-94497.
   • When a fixed release is published, upgrade immediately and re-validate that ownership checks are enforced on all by-id info, update, and delete endpoints before removing compensating controls.

3. Long-term hardening:

   • Implement server-side object-level authorization (BOLA/IDOR defenses): every by-id operation must verify that the authenticated principal owns or is explicitly authorized for the referenced object.
   • Adopt centralized authorization middleware to prevent inconsistent checks across "multiple resource types."
   • Enforce tenant scoping at the data-access layer (e.g., mandatory tenant/user constraints in queries) so that identifier substitution cannot cross ownership boundaries.
   • Replace predictable sequential identifiers with non-guessable references where appropriate, as a defense-in-depth measure — not as a substitute for authorization.
   • Integrate object-authorization tests into CI/CD and conduct regular access-control reviews.

References

• NVD — CVE-2026-94497: https://nvd.nist.gov/vuln/detail/CVE-2026-94497
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• OWASP API Security Top 10 — API1:2023 Broken Object Level Authorization: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
• jshERP project repository / vendor releases (monitor for post-3.6 fixes): https://github.com/jishenghua/jshERP
• CISA KEV Catalog (CVE-2026-94497 not listed as of this assessment): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-94497 at the time of writing. No threat actor campaigns have been attributed to this CVE. EPSS has not yet scored this vulnerability per FIRST.org.