Is CVE-2026-94495 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94495?

CVE-2026-94495 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-94495

Description

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.