CVE-2026-94496: jshERP Privilege Escalation Vulnerability

CVE-2026-94496 Overview

CVE-2026-94496 is a missing authorization vulnerability [CWE-862] in jshERP through version 3.6, an open-source enterprise resource planning platform. The /role/update and /role/delete endpoints in the RoleController fail to validate caller permissions before executing role management operations. Any authenticated tenant user can modify arbitrary roles, expand data scope to view all records, or delete roles entirely. Successful exploitation enables privilege escalation and unauthorized access to all business data within the tenant.

Critical Impact
Authenticated low-privilege users can tamper with any role in the tenant, escalate privileges, and read all business records without administrator interaction.

Affected Products

jshERP through version 3.6
jshERP-boot backend service
RoleController role management API endpoints

Discovery Timeline

2026-09-21 - CVE-2026-94496 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94496

Vulnerability Analysis

The flaw resides in jshERP's role management controller. The /role/update and /role/delete handlers accept requests from any authenticated session without confirming the caller holds role administration privileges. As a result, a standard tenant user can submit crafted requests that modify another role's dataType field or remove the role entirely. Changing dataType to the value representing all data grants the associated users visibility across every business record in the tenant, bypassing the application's data-scope isolation model.

Root Cause

The RoleController methods for updating and deleting roles lack an authorization check tied to the caller's assigned permissions. Authentication alone is treated as sufficient. The jshERP-boot code path at RoleController.java lines 76-98 exposes the mutation endpoints without invoking a permission filter or verifying the caller can manage roles. See the GitHub RoleController Code Review for the affected source.

Attack Vector

An attacker authenticates to jshERP with any valid tenant account. The attacker then issues a POST request to /role/update carrying a target role ID and a modified dataType payload that widens visibility to all data. Alternatively, the attacker calls /role/delete to remove roles and disrupt access controls. No user interaction and no administrator privileges are required. A working proof of concept is published at the GitHub PoC Repository, and additional analysis is available in the VulnCheck Privilege Escalation Advisory.

Detection Methods for CVE-2026-94496

Indicators of Compromise

Unexpected HTTP POST requests to /role/update or /role/delete originating from non-administrator user sessions.
Role records whose dataType field has been changed to the value representing all-data visibility without a corresponding administrator change ticket.
Sudden deletions of roles in the jsh_role table with no matching audit entry from a privileged account.

Detection Strategies

Enable access logging on the jshERP-boot service and alert when /role/update or /role/delete is invoked by user IDs that do not belong to the role administrator group.
Perform periodic diffs on the jsh_role table to detect unauthorized changes to dataType, permission, or role membership.
Correlate authentication logs with subsequent business data queries to identify accounts whose data-scope suddenly expanded.

Monitoring Recommendations

Forward jshERP application logs and database audit trails to a centralized SIEM for correlation and long-term retention.
Baseline normal role management activity by user, time-of-day, and source IP, then alert on deviations.
Monitor for bulk record reads immediately following role modification events, which suggests privilege escalation followed by data exfiltration.

How to Mitigate CVE-2026-94496

Immediate Actions Required

Restrict network access to the jshERP administrative interface to trusted internal networks or VPN users only.
Review the jsh_role table and revert any unauthorized dataType changes or role deletions.
Rotate credentials for accounts suspected of exploiting the endpoints and force re-authentication for all tenant users.
Audit recent access to sensitive business records for signs of unauthorized reads following role modifications.

Patch Information

No vendor-issued patch is referenced in the advisory at time of publication. Track the GitHub jshERP Project for upstream fixes and monitor the VulnCheck Privilege Escalation Advisory for updated guidance. Until a fixed release is available, apply the workarounds below.

Workarounds

Add a server-side authorization filter that verifies the caller holds role management permissions before executing /role/update and /role/delete.
Deploy a reverse proxy or web application firewall rule that blocks requests to /role/update and /role/delete unless the source is an administrator session.
Disable low-privilege user access to the role management module through application configuration where supported.
Enforce least-privilege principles by removing unused accounts and reducing the number of users who can authenticate to the ERP tenant.

bash

# Example nginx rule restricting role management endpoints by source IP
location ~ ^/(role/update|role/delete)$ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://jsherp_backend;
}