CVE-2026-94414

Summary

The flaw allows authenticated users to modify role button-permission definitions without proper authorization checks, enabling them to overwrite configurations for any role in the tenant.

Exploitability

Exploitation requires an authenticated user with access to the POST /userBusiness/updateBtnStr endpoint. The attacker must supply valid roleId and btnStr parameters.

Blast radius

If exploited, attackers can compromise button-permission settings across all roles within the tenant, potentially leading to unauthorized access or operational disruptions.

Prioritized remediation

Implement proper authorization checks on the POST /userBusiness/updateBtnStr endpoint to validate user privileges before modifying role button-permissions.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.