CVE-2026-11469 is a server-side request forgery vulnerability affecting jishenghua jshERP up to version 3.6. The vulnerability resides in the insertPlatformConfig function within the PlatformConfigService.java file, specifically in the handling of the platformValue argument. An attacker with high privileges can remotely manipulate this argument to induce the server to perform unintended requests. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not issued any official fix or mitigation guidance.

Successful exploitation could allow an attacker with high privileges to cause the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. This could lead to information disclosure or further attacks leveraging internal network trust. However, the vulnerability requires high privileges to exploit and has limited scope and impact as indicated by the medium CVSS score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations should monitor for updates from the vendor. Until a patch is available, restrict access to the affected function to trusted users only and consider implementing network-level controls to limit the server's ability to make arbitrary outbound requests.