The vulnerability exists in the updateOneValueByKeyIdAndType endpoint of jshERP 3.6. A POST request to this endpoint can include a type=UserRole parameter, the requester's own user ID, and a list of role IDs. Because the server accepts these values without authorization checks, an authenticated user can assign any role identifiers to themselves. This allows a user with normal tenant privileges to grant themselves administrative privileges within the same tenant. The flaw is an example of CWE-862, an Improper Authorization vulnerability.

Product: jshERP by jishenghua, version 3.6. The affected component is the UserBusinessController’s updateOneValueByKeyIdAndType method, which is invoked for user role updates.

The CVSS base score of 8.7 classifies this as a High severity issue. The EPSS score is unavailable, so the exact exploitation probability is unknown. The vulnerability does not appear in the CISA KEV catalog, implying no publicly documented exploits yet. Attackers must be authenticated, making the likely attack vector a remote, web‑based action inferred from the fact that the vulnerable endpoint is accessed via an authenticated POST request. Exploitation would enable the attacker to obtain tenant administrator rights, giving full control over tenant data and configuration.