Is CVE-2026-94412 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94412?

CVE-2026-94412 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-94412

Description

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.