CVE-2026-94501: jshERP through 3.6 Privilege Escalation via userBusiness CRUD
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user can exploit the vulnerable userBusiness CRUD endpoints. The provided data does not indicate that a specific role or elevated privilege is required.
What can an attacker do after exploiting the authorization bypass?
An attacker can create, modify, or delete authorization-relation rows without privilege checks. This can be used to alter user-role mappings and access controls, escalate privileges, remove other users' access, or change role-function relationships for users in the same tenant.
Are unauthenticated deployments exposed?
The issue requires authentication, so an unauthenticated remote attacker cannot exploit it directly based on the provided information. Any account with access to the affected endpoints may present a privilege-escalation risk.