CVE-2026-109186: Improperly Controlled Modification of Dynamically-Determined Object Attributes in jishenghua jshERP

CVE-2026-109186 is a mass assignment vulnerability in jshERP through version 3.6. The issue exists in the UserController update handler, where authenticated users can send a crafted PUT /user/update request to overwrite protected attributes including tenant_id and password. This improper control over dynamically-determined object attributes enables attackers to switch tenants or overwrite password hashes of other users, facilitating unauthorized access or account takeover.

An attacker with authentication privileges can manipulate protected user attributes, enabling tenant switching or password hash overwriting. This can lead to unauthorized access to other tenants' data or account takeover of other users, representing a high security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the UserController update functionality to trusted users only and monitor for suspicious activity related to user updates.