CVE-2026-94501

Summary

The flaw allows authenticated users to bypass authorization checks in jshERP through 3.6, enabling them to manipulate user-role mappings and escalate privileges.

Exploitability

Exploitation requires authentication but no specific technical skills; preconditions include access to the affected software version.

Blast radius

If exploited, attackers can strip access from other accounts or modify role-function relationships, significantly impacting system security and integrity.

Prioritized remediation

Update to the latest version of jshERP, which should address this vulnerability.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.