CVE-2026-94414 — jshERP through 3.6 Missing Authorization via updateBtnStr
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions…
Published: 2026-09-21 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7