Description
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
Published: 2026-10-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

An authenticated user can exploit a missing authorization check in jshERP’s /user/updateUser endpoint to assign any role to any user, mapping to Missing Authorization (CWE-862). This flaw allows low‑privileged accounts to elevate themselves or rebind other tenant users to administrator roles, granting unrestricted control over the application and its data.

Affected Systems

The flaw is present in jshERP versions up to 3.6, distributed by jishenghua. All installations using jshERP 3.6 or earlier are potentially affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity, and is not listed in the CISA KEV catalog. Attackers only need to authenticate and can send a PUT request to /user/updateUser with a target user ID and desired role ID; the lack of authorization verification causes the request to succeed. This capability is exploitable over network channels and does not require elevated system privileges beyond those of the logged‑in user.

Generated by OpenCVE AI on October 12, 2026 at 15:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade jshERP to the latest release or apply the vendor‑supplied patch that enforces proper role‑assignment authorization.
  • Restrict the PUT /user/updateUser endpoint so that only authenticated administrators can access it and block it for regular users.
  • Add ACL checks to confirm that only the target account owner or an administrator may modify role assignments.

Generated by OpenCVE AI on October 12, 2026 at 15:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
Title jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
First Time appeared Jishenghua
Jishenghua jsherp
Weaknesses CWE-862
CPEs cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*
Vendors & Products Jishenghua
Jishenghua jsherp
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jishenghua Jsherp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:40:52.323Z

Reserved: 2026-10-12T12:57:38.138Z

Link: CVE-2026-109185

cve-icon Vulnrichment

Updated: 2026-10-13T18:40:31.994Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T13:17:31.840

Modified: 2026-10-13T19:18:13.570

Link: CVE-2026-109185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T15:30:14Z

Weaknesses