CVE-2026-11469 is a server-side request forgery vulnerability in the jshERP product by jishenghua affecting versions 3.0 through 3.6. The vulnerability resides in the insertPlatformConfig function within the PlatformConfigService.java file. By manipulating the platformValue argument, an attacker can cause the server to perform unauthorized requests. The vulnerability is remotely exploitable without user interaction and requires high privileges. Although an exploit is publicly available, the vendor has not provided a patch or official remediation at this time.

Successful exploitation allows an attacker with high privileges to induce the server to make arbitrary requests, potentially leading to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected functionality to trusted users with high privileges and consider network-level controls to limit outbound requests from the server.