CVE-2026-94411: jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jshERPto a version that resolves this vulnerability.Fixed in 3.6Patch Privilege Escalation via updateOneValueByKeyIdAndType
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege tenant user can exploit it. The attacker needs access to their own user ID and a role ID list, then can submit a POST request using type=UserRole.
Is user interaction required?
No. The issue has no user-interaction requirement; an authenticated attacker can perform the escalation directly through the affected endpoint.
What access can an attacker gain?
The attacker can grant themselves arbitrary roles and escalate from a low-privilege tenant user to a tenant administrator. This can result in high-impact compromise of confidentiality, integrity, and availability.