CVE-2026-94414: jshERP through 3.6 Missing Authorization via updateBtnStr
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jshERPto a version that resolves this vulnerability.Fixed in 3.6 - Compensating control
Restrict access to the POST /userBusiness/updateBtnStr endpoint (e.g., via network/WAF/ACL) so only authorized administrators/roles can call it, until the missing authorization is fixed.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user can exploit the affected endpoint. The attacker does not need elevated privileges because the endpoint does not validate authorization for the supplied role identifier.
What access is required to change another role's button permissions?
The attacker needs an authenticated session and the ability to send a POST request to /userBusiness/updateBtnStr. They can provide arbitrary roleId and btnStr values to overwrite button-permission definitions for roles in the tenant.
What is the practical impact of a successful exploit?
An attacker can alter button-level permissions assigned to roles, potentially granting or removing access to application functions for users holding those roles. The reported impact includes integrity and availability effects, but not confidentiality impact.