CVE-2026-94495: jshERP Privilege Escalation Vulnerability

CVE-2026-94495 Overview

CVE-2026-94495 is a missing authorization vulnerability [CWE-862] affecting jshERP through version 3.6. The flaw resides in the SystemConfigService.updateSystemConfig method, which fails to validate user privileges before applying tenant-wide configuration changes. Any authenticated user can invoke the systemConfig endpoint to rewrite or delete settings that govern company identity, stock rules, approval workflows, and printing configuration. Because the endpoint has no role check, low-privileged accounts can silently reshape ERP business logic used by every tenant user.

Critical Impact
Authenticated attackers with any user role can tamper with tenant-wide ERP configuration, corrupting company identity data, inventory constraints, approval logic, and print output.

Affected Products

jshERP through version 3.6
SystemConfigController and SystemConfigService.updateSystemConfig code paths
Deployments exposing the systemConfig REST endpoint to authenticated users

Discovery Timeline

2026-09-21 - CVE-2026-94495 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94495

Vulnerability Analysis

jshERP is an open-source enterprise resource planning platform written in Java. The SystemConfigController exposes an update endpoint that is intended for administrative tenant configuration changes. In version 3.6, the controller forwards requests directly to SystemConfigService.updateSystemConfig without invoking a role or permission check.

The result is broken access control. Any account that can authenticate to the application acquires the ability to overwrite tenant-scoped configuration records. These records include company name and branding fields, stock-movement rules, approval routing behavior, and print template configuration.

Because the settings are read by every downstream service, tampering has cascading impact. Modified stock rules can bypass inventory validation, altered approval settings can neutralize authorization gates on financial workflows, and modified print configuration can inject attacker-controlled text into generated documents.

Root Cause

The root cause is a missing authorization check in the update handler. The controller method between lines 93 and 115 of SystemConfigController.java on the v3.6 branch accepts a configuration payload and persists it without verifying that the caller holds a tenant administrator role. Authentication is enforced, but authorization is not, matching the pattern described by CWE-862.

Attack Vector

Exploitation requires only network access to the jshERP web interface and a valid low-privileged session token. The attacker sends a crafted HTTP request to the systemConfig endpoint with a JSON body containing replacement values for tenant configuration fields. The server applies the write and returns success. A public proof-of-concept script demonstrating the tampering flow is available in the GitHub PoC for jshERP. No user interaction is required beyond obtaining an authenticated session.

For the vulnerable handler, see the jshERP SystemConfigController source and the VulnCheck advisory on jshERP.

Detection Methods for CVE-2026-94495

Indicators of Compromise

HTTP POST or PUT requests to the systemConfig endpoint originating from non-administrator user sessions.
Unexpected changes to tenant fields such as company name, stock rules, approval configuration, or print templates in the system_config database table.
Configuration writes clustered outside normal administrator working hours or from unusual source IP addresses.

Detection Strategies

Audit application access logs for calls to SystemConfigController.updateSystemConfig and correlate the caller identity against the tenant administrator role list.
Enable database-level triggers or change data capture on the system_config table to record every write with the invoking user ID.
Compare current configuration values against a known-good baseline to identify silent tampering.

Monitoring Recommendations

Alert on any systemConfig update where the authenticated principal does not hold an administrative role.
Track the rate of configuration write attempts per user; a non-admin issuing writes is a high-fidelity signal.
Forward jshERP application logs and web server logs into a centralized SIEM for retention and correlation with authentication events.

How to Mitigate CVE-2026-94495

Immediate Actions Required

Restrict network access to the jshERP systemConfig endpoint using a reverse proxy or web application firewall rule that limits it to administrator source addresses.
Review the system_config table for unauthorized modifications and restore from a trusted backup where drift is detected.
Rotate credentials for low-privileged accounts and audit recent account creations to identify potential abuse.

Patch Information

No vendor patch has been referenced in the CVE record at the time of publication. Monitor the jshERP GitHub repository for a fixed release beyond version 3.6 and consult the VulnCheck advisory on jshERP for updates.

Workarounds

Apply a local source-code patch that adds an explicit role check to SystemConfigService.updateSystemConfig before persisting changes.
Block POST and PUT requests to the systemConfig path at the web tier for all users not in the tenant administrator group.
Take a signed baseline snapshot of tenant configuration and run scheduled diffs to detect and revert unauthorized writes.

bash

# Example NGINX rule restricting the systemConfig endpoint to an admin subnet
location /jshERP-boot/systemConfig/ {
    allow 10.10.20.0/24;   # admin management network
    deny all;
    proxy_pass http://jsherp_upstream;
}