CVE-2025-55367 describes an incorrect access control vulnerability in the \controller\SupplierController.java component of jshERP version 3.5. This flaw permits unauthorized attackers to arbitrarily change the supplier status under any user account. The vulnerability is classified under CWE-284 (Improper Access Control). The CVSS v3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No official patch or vendor advisory is provided, and no exploits are known in the wild.

The vulnerability allows unauthorized modification of supplier status, potentially leading to unauthorized changes in supplier data integrity. Confidentiality impact is limited, and there is no impact on availability or integrity beyond the supplier status modification. Since no privileges or user interaction are required, the attack surface is broad, but the overall impact is medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected component and monitor for unauthorized changes. Implement additional access control measures if possible.