CVE-2026-94496
8.3 HIGHpublic exploit availablePublished 2026-09-21 · Updated 2026-09-22
AI risk analysis
- Summary
- The flaw allows authenticated users to modify role permissions, potentially leading to privilege escalation and unauthorized access to all business records.
- Exploitability
- Exploitation is relatively straightforward for authenticated users with access to the /role/update and /role/delete endpoints.
- Blast radius
- If exploited, attackers can gain full access to all business records within the tenant, severely impacting data security and privacy.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to jshERP 3.6.1 or later.
auth-bypasspriv-escalationweb
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-862
Public exploit & PoC references
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-11-role-tamper.py
- https://github.com/jishenghua/jshERP
- https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/RoleController.java#L76-L98
- https://www.vulncheck.com/advisories/jsherp-through-3.6-privilege-escalation-via-role-management
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.