CVE-2026-94412

Summary

This vulnerability allows authenticated users to reset any other user's password, enabling unauthorized access to accounts, including administrative ones.

Exploitability

Exploitation is relatively straightforward as it requires an authenticated user to submit a request with an arbitrary target user ID. Precondition is the attacker must already have valid credentials.

Blast radius

If exploited, this could lead to unauthorized access to sensitive user accounts, potentially compromising the entire system, including administrative accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to jshERP 3.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.