CVE-2025-55366 describes an access control weakness in the \controller\UserController.java component of jshERP version 3.5. This flaw permits attackers to reset passwords of user accounts without proper authorization, facilitating horizontal privilege escalation. The vulnerability is classified under CWE-284 (Improper Access Control). The CVSS 3.1 base score is 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no information about available patches or fixed versions, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized attackers to reset passwords of arbitrary user accounts, which can lead to horizontal privilege escalation. This compromises user account integrity and could allow attackers to impersonate other users within the system. The confidentiality impact is low, with no integrity or availability impacts reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious password reset activities. Avoid deploying jshERP v3.5 in untrusted environments without additional access controls.