CVE-2026-109187

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Low-privilege authenticated users across any tenant can extract platform-wide secrets like SMTP authorization codes and activation tokens. Attackers only need network access and basic user credentials on the application.

Root cause

The getInfoByKey endpoint in PlatformConfigController lacks proper authorization checks, blacklisting only 'aliOss' and 'weixin' keys instead of restricting configuration access to administrators.

Affected systems

jshERP through 3.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to a fixed release once published by the vendor. In the interim, block incoming HTTP traffic to the getInfoByKey endpoint path or restrict access to PlatformConfigController via an upstream reverse proxy or WAF.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109187