CVE-2026-94411

Summary

The vulnerability allows authenticated users to escalate their privileges by sending a POST request with specific parameters, enabling them to assume arbitrary roles, including tenant administrator.

Exploitability

Exploitation requires authentication and knowledge of user ID and role IDs; moderate difficulty due to need for detailed information.

Blast radius

If exploited, the impact could be severe as it grants full administrative access to the system, potentially leading to complete control over the application or data.

Prioritized remediation

Update jshERP to the latest version that addresses this vulnerability or apply a patch if available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.