CVE-2026-109185 — jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user.…
Published: 2026-10-12 · CVSS: 8.7 · CVSS 4.0
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7