Description
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
Published: 2026-09-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

jshERP versions through 3.6 contain a flaw in the role management API – the /role/update and /role/delete endpoints fail to verify the caller's permissions. An authenticated user can change a role’s data scope or delete a role, giving access to all business data within the tenant. The impact is a complete elevation of privileges and unrestricted visibility over sensitive information.

Affected Systems

The vulnerable software is jshERP by jishenghua, affecting all releases up to and including version 3.6. Any installation of those releases is potentially susceptible unless patched to a newer version.

Risk and Exploitability

The vulnerability assigns a CVSS score of 8.7, indicating high severity. No EPSS score is available, and the issue is not listed in CISA KEV, which suggests no confirmed public exploitation yet. Because the flaw can be triggered by any authenticated user, the attack vector is straightforward: call the role endpoints to modify permissions or delete roles and gain unrestricted data access.

Generated by OpenCVE AI on September 21, 2026 at 19:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade jshERP to the latest version that includes the role permission fix.
  • Configure role management API access so that only administrators can call /role/update and /role/delete, and enforce strict permission checks.
  • Review and audit all existing role definitions to ensure no over‑permissive roles exist, and monitor role changes for suspicious activity.

Generated by OpenCVE AI on September 21, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
Title jshERP through 3.6 Privilege Escalation via Role Management
First Time appeared Jishenghua
Jishenghua jsherp
Weaknesses CWE-862
CPEs cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*
Vendors & Products Jishenghua
Jishenghua jsherp
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Jishenghua Jsherp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-21T19:05:03.289Z

Reserved: 2026-09-21T17:52:01.686Z

Link: CVE-2026-94496

cve-icon Vulnrichment

Updated: 2026-09-21T19:04:56.977Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T19:17:21.590

Modified: 2026-09-22T20:43:58.793

Link: CVE-2026-94496

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T21:00:07Z

Weaknesses