CVE-2026-94412 is an authorization bypass vulnerability (CWE-862) in jshERP through version 3.6. The flaw exists in the POST /user/resetPwd endpoint, which lacks proper authorization validation. Authenticated attackers can exploit this by submitting a request with an arbitrary user ID, resetting the password of any user to a known default. This enables unauthorized access to other user accounts, including those with administrative privileges. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with valid authentication can reset the password of any user, including administrators, to a known default value. This leads to unauthorized account takeover, potentially compromising sensitive data and administrative control within the affected jshERP system. The vulnerability impacts confidentiality, integrity, and availability of the system.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password reset endpoint to trusted users only and monitor for suspicious password reset activity. Implement additional authorization checks if possible.