CVE-2026-94414: jshERP Authorization Bypass Vulnerability

CVE-2026-94414 Overview

CVE-2026-94414 is a missing authorization vulnerability in jshERP through version 3.6. The flaw resides in the POST /userBusiness/updateBtnStr endpoint of the UserBusinessController. The endpoint fails to verify whether the calling user holds administrative privileges before modifying role button-permission definitions. Any authenticated tenant user can submit arbitrary roleId and btnStr parameters to overwrite the button-permission configuration for any role. This weakness is tracked under CWE-862: Missing Authorization.

Critical Impact

Low-privileged authenticated users can tamper with role button-permission configurations across the tenant, altering the UI-level access controls that govern administrative and business functions.

Affected Products

• jshERP through version 3.6
• jshERP UserBusinessController component (jshERP-boot/src/main/java/com/jsh/erp/controller/UserBusinessController.java)
• Deployments exposing the /userBusiness/updateBtnStr endpoint to authenticated tenant users

Discovery Timeline

• 2026-09-21 - CVE-2026-94414 published to the National Vulnerability Database (NVD)
• 2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-94414

Vulnerability Analysis

jshERP is an open-source enterprise resource planning (ERP) platform written in Java and Spring Boot. Role-based access control within the UI is enforced through button-permission strings (btnStr) associated with each role identifier (roleId). The updateBtnStr handler in UserBusinessController accepts these two parameters over HTTP POST and persists the resulting permission mapping. The controller does not verify whether the calling session belongs to an administrator or has any capability to manage roles. As a result, the operation trusts the session solely for authentication rather than authorization. An attacker with any valid tenant login can send crafted requests that rewrite button permissions for privileged roles, potentially granting or removing UI-level access to sensitive business functions.

Root Cause

The root cause is a missing server-side authorization check on a state-changing administrative endpoint. Authentication is validated, but no role, capability, or ownership check gates the write operation. The controller directly maps request-supplied roleId and btnStr values to persistence logic. This is a canonical CWE-862 broken access control defect.

Attack Vector

Exploitation requires network reachability to the jshERP HTTP interface and a low-privilege authenticated session in the target tenant. The attacker issues a POST /userBusiness/updateBtnStr request supplying the target role identifier and an arbitrary button-permission string. The server accepts and stores the new configuration without validating the caller's authorization. A public proof-of-concept script demonstrating the request flow is available at the GitHub PoC Script. Vulnerable source lines are documented in the UserBusinessController Code and the VulnCheck Advisory.

Detection Methods for CVE-2026-94414

Indicators of Compromise

• HTTP POST requests to /userBusiness/updateBtnStr originating from non-administrator user sessions.
• Unexpected changes to user_business records where the type field references button-permission mappings.
• Requests supplying roleId values corresponding to privileged roles from low-privilege accounts.
• Application logs showing successful updateBtnStr operations without a preceding administrative action.

Detection Strategies

• Enable verbose access logging on the jshERP controller layer and alert on any invocation of updateBtnStr outside authorized administrator sessions.
• Baseline the set of accounts legitimately permitted to modify role permissions and flag deviations.
• Deploy web application firewall (WAF) rules that inspect the URI path /userBusiness/updateBtnStr and correlate the request with the caller's role.

Monitoring Recommendations

• Continuously monitor the user_business table for unauthorized inserts or updates and generate audit events on change.
• Forward jshERP application and access logs to a centralized analytics platform for correlation with authentication events.
• Track sequences where a non-administrator authentication is quickly followed by role permission changes and privilege enumeration.

How to Mitigate CVE-2026-94414

Immediate Actions Required

• Restrict network access to the jshERP /userBusiness/* endpoints so they are reachable only from trusted management networks.
• Audit all recent modifications to role button-permission strings and revert unauthorized changes.
• Review current tenant accounts and disable inactive or unnecessary logins to reduce the pool of potential attackers.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of publication. Monitor the jshERP repository and the VulnCheck Advisory for fix releases. Operators maintaining custom forks should add a server-side authorization check to the updateBtnStr handler that verifies the caller holds a role-management capability before persisting changes.

Workarounds

• Place jshERP behind a reverse proxy that enforces an allowlist requiring administrator authentication for the /userBusiness/updateBtnStr path.
• Add a servlet filter or Spring interceptor that inspects the authenticated principal and rejects updateBtnStr requests from non-administrator roles.
• Rotate credentials for all tenant accounts and enforce strong password policies to reduce the risk of compromised low-privilege sessions.

# Example nginx reverse proxy rule restricting the vulnerable endpoint
location = /userBusiness/updateBtnStr {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://jsherp_backend;
}