CVE-2025-7947 | jshERP up to 3.5 Account /user/delete ID improper authorization (Issue 124)

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization.

This vulnerability is traded as CVE-2025-7947. It is possible to launch the attack remotely. Furthermore, there is an exploit available.