CVE-2026-94501: jshERP Auth Bypass Vulnerability

CVE-2026-94501 Overview

CVE-2026-94501 is an authorization bypass vulnerability in jshERP through version 3.6. The flaw affects the userBusiness CRUD endpoints in UserBusinessController.java, which fail to enforce privilege checks on authorization-relation operations. Any authenticated user can create, modify, or delete user-role mappings and role-function relationships for other accounts in the tenant. This enables attackers to escalate their own privileges, revoke access from legitimate users, or reassign role bindings across the ERP deployment. The weakness is classified as [CWE-862] Missing Authorization.

Critical Impact

Authenticated attackers can escalate to administrative privileges and manipulate access controls for any user in the jshERP tenant.

Affected Products

• jshERP versions up to and including 3.6
• jshERP-boot application component
• UserBusinessController endpoints handling authorization-relation records

Discovery Timeline

• 2026-09-21 - CVE-2026-94501 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94501

Vulnerability Analysis

The vulnerability resides in the UserBusinessController class of jshERP-boot. The controller exposes create, update, and delete operations against the userBusiness entity, which stores authorization-relation rows binding users to roles and roles to functions. These operations execute without validating whether the calling account has administrative rights over the target relationship.

Because jshERP represents role assignments, permission grants, and functional access through userBusiness records, unauthorized writes to this table directly alter the effective permissions model. An attacker holding low-privilege credentials can add themselves to administrator role mappings, remove other accounts from privileged groups, or rewrite role-function bindings to grant broad access.

The VulnCheck advisory and the referenced proof-of-concept demonstrate deletion of authorization-relation rows for arbitrary users, resulting in denial of access and privilege redistribution across the tenant.

Root Cause

The root cause is missing authorization enforcement in the controller layer. The endpoints authenticate the session but do not verify that the caller owns or administers the target userBusiness record. Access decisions are delegated to no downstream component, matching the [CWE-862] pattern of a sensitive function reachable without authorization checks.

Attack Vector

The attack is executed over the network by any authenticated jshERP user. The attacker sends crafted requests to the userBusiness create, update, or delete endpoints exposed by UserBusinessController, referencing target user IDs and role identifiers of their choosing. No user interaction is required, and the exploitation complexity is low.

The vulnerability manifests in the CRUD handlers between lines 50 and 80 of UserBusinessController.java in the v3.6 branch. Refer to the VulnCheck Privilege Escalation Advisory and the GitHub PoC for request structure details.

Detection Methods for CVE-2026-94501

Indicators of Compromise

• Unexpected HTTP requests from low-privilege sessions to /userBusiness/add, /userBusiness/update, or /userBusiness/delete endpoints.
• Audit log entries showing modifications to user-role or role-function mappings that were not initiated by an administrator account.
• Sudden appearance of new administrator-level accounts or role assignments in the jshERP user_business table.

Detection Strategies

• Inspect application access logs for userBusiness CRUD calls originating from accounts that lack administrative role membership.
• Baseline expected callers of authorization-management endpoints and alert on deviations.
• Correlate authentication events with subsequent privilege changes to identify self-escalation patterns.

Monitoring Recommendations

• Enable database auditing on the user_business table to capture INSERT, UPDATE, and DELETE operations with the executing session context.
• Forward jshERP application and database audit logs to a centralized analytics platform for correlation with identity telemetry.
• Monitor for repeated failed or successful role-reassignment activity within short time windows.

How to Mitigate CVE-2026-94501

Immediate Actions Required

• Restrict network exposure of the jshERP application so that only trusted users on internal networks can reach the userBusiness endpoints.
• Audit the user_business table for unauthorized role assignments and remove any illegitimate entries.
• Rotate credentials for accounts suspected of being used to exploit the CRUD endpoints and review recent privilege changes.

Patch Information

As of the NVD publication on 2026-09-21, no vendor patch is referenced for jshERP 3.6. Track the jshERP GitHub repository for updates and apply an authorization check on UserBusinessController methods when a fix becomes available. Review the vulnerable code path in the UserBusinessController source to guide internal remediation.

Workarounds

• Add a reverse-proxy or web application firewall rule that limits userBusiness CRUD paths to administrator source IPs or authenticated admin sessions.
• Apply a local code change enforcing role checks on all UserBusinessController handlers, rejecting requests from non-administrative principals.
• Disable or remove low-privilege accounts that are not strictly required until authorization enforcement is verified.

# Example nginx rule restricting userBusiness endpoints to an admin subnet
location ~ ^/jshERP-boot/userBusiness/(add|update|delete|deleteBatch) {
    allow 10.10.20.0/24;   # admin management subnet
    deny all;
    proxy_pass http://jsherp_backend;
}