CVE-2026-94413 describes a vulnerability in jshERP through version 3.6 where the /user/info API endpoint fails to redact password hashes. Authenticated users can request arbitrary user information by specifying user IDs, thereby obtaining unsalted MD5 password hashes of any user. These hashes can be used for offline password cracking or direct authentication bypass. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction.

The vulnerability allows authenticated users to access unsalted MD5 password hashes of any user, exposing sensitive credential information. This can lead to offline password cracking attempts or direct authentication bypass, compromising user accounts. There is no indication of impact on integrity or availability.

No patch or official fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /user/info endpoint to trusted users only and monitor for unusual access patterns. Consider enforcing stronger password hashing mechanisms and limiting exposure of sensitive data in API responses.