CVE-2026-94501 — jshERP through 3.6 Privilege Escalation via userBusiness CRUD
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-r…
Published: 2026-09-21 · CVSS: 8.7 · CVSS 4.0
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7