CVE-2026-94496: jshERP through 3.6 Privilege Escalation via Role Management
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated jshERP user with low-level access can exploit the affected role management endpoints. No user interaction is required.
What access can an attacker gain?
An attacker can modify another role's data scope to expose all tenant data, enabling access to all business records in that tenant. They can also alter roles to escalate privileges or delete roles.
Which endpoints should be prioritized for investigation or restriction?
Prioritize /role/update and /role/delete, which allow unauthorized role data-scope modification and role deletion. Review requests to these endpoints for changes initiated by accounts that should not administer roles.