CVE-2026-109185

Summary

The jshERP application has a missing authorization check in its user management functionality that allows low-privilege authenticated users to assign administrator roles to any user account, enabling privilege escalation and cross-tenant role manipulation.

Exploitability

Exploitation requires an authenticated user account with minimal privileges and involves sending a crafted request with a target user ID and tenant administrator role ID, making it moderately easy to execute with available public exploits.

Blast radius

The vulnerability could allow attackers to gain full administrative access across tenant boundaries, potentially compromising multiple user accounts and enabling widespread privilege escalation within the application.

Detection

Monitor for unusual role assignment patterns in application audit logs where low-privilege users are observed modifying roles of other users, particularly when assigning tenant administrator roles.

Prioritized remediation

Upgrade to jshERP version 3.7 or later to address this missing authorization vulnerability in the UserController updateUser handler.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.