CVE-2025-55366

MediumCVSS 5.3

Published: 21/08/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

In jshERP v3.5, incorrect access control in the UserController.java component allows attackers to arbitrarily reset user account passwords. This vulnerability enables a horizontal privilege escalation attack.

Risk Assessment

An attacker can take over other users' accounts, leading to unauthorized access to data and system functions. This may result in a breach of confidentiality and integrity of information within the organization.

Recommendation

Immediately update jshERP to the latest version that fixes this vulnerability. If an update is not possible, implement additional authorization mechanisms for password reset operations.

Original NVD description (English source)

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.