{"id":"CVE-2026-94414","published":"2026-09-21T19:17:20.800","lastModified":"2026-09-21T19:17:20.800","description":"jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-06-userbusiness-btnstr-tamper.py","tags":[]},{"url":"https://github.com/jishenghua/jshERP","tags":[]},{"url":"https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserBusinessController.java#L149-L170","tags":[]},{"url":"https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-via-updatebtnstr","tags":[]}],"exploitRefs":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-06-userbusiness-btnstr-tamper.py","tags":[]},{"url":"https://github.com/jishenghua/jshERP","tags":[]},{"url":"https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserBusinessController.java#L149-L170","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to modify role button-permission definitions without proper authorization checks, enabling them to overwrite configurations for any role in the tenant.","exploitability":"Exploitation requires an authenticated user with access to the POST /userBusiness/updateBtnStr endpoint. The attacker must supply valid roleId and btnStr parameters.","blast_radius":"If exploited, attackers can compromise button-permission settings across all roles within the tenant, potentially leading to unauthorized access or operational disruptions.","remediation":"Implement proper authorization checks on the POST /userBusiness/updateBtnStr endpoint to validate user privileges before modifying role button-permissions.","tags":["auth-bypass","web","permissions"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:25:57.294Z"}}