CVE-2026-109185: jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privilege jshERP user can exploit it. The attacker must be able to send a PUT request to the /user/updateUser endpoint.
What does an attacker need to provide to escalate privileges?
The attacker can submit their own user ID together with the tenant administrator roleId. The vulnerable handler permits arbitrary role assignment because it lacks authorization checks.
Can this issue affect accounts other than the attacker's own account?
Yes. An authenticated attacker can also rebind roles for other users in the same tenant, potentially changing those users' assigned privileges.
How can administrators look for signs of exploitation?
Review user role changes for unexpected assignments of the tenant administrator role, especially changes initiated by low-privilege accounts. Also inspect requests to PUT /user/updateUser that modify roleId values or target user IDs not normally managed by the requesting user.