CVE-2026-94495 is a missing authorization vulnerability (CWE-862) in jshERP through version 3.6. The issue occurs in the SystemConfigService.updateSystemConfig method, where user privileges are not properly validated. As a result, authenticated users can modify or delete tenant-wide system configuration settings via the systemConfig endpoint. These settings include company identity, stock rules, approval behavior, and printing configuration, potentially impacting system integrity and operational behavior.

The vulnerability allows authenticated users with insufficient privileges to alter critical tenant-wide system configurations. This can lead to unauthorized changes in company identity information, stock management rules, approval workflows, and printing settings. While confidentiality is not impacted, the integrity of system configurations is compromised, and availability impact is low. The CVSS score of 7.1 reflects a high severity due to the integrity impact and ease of exploitation by authenticated users.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the systemConfig endpoint to only fully trusted and authorized users. Monitor and audit configuration changes closely to detect unauthorized modifications.