Authenticated Privilege Escalation in jshERP SystemConfigService

Executive Summary

CVE-2026-94495 is a missing authorization vulnerability in jshERP versions up to 3.6. It allows authenticated users to modify tenant system configurations without proper privilege validation. Attackers can rewrite or delete tenant-wide settings like company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized POST or PUT requests to the systemConfig endpoint. Check if authenticated low-privilege users can modify tenant-wide settings. Use the provided PoC script to test if the system allows unauthorized configuration changes. Monitor database changes in the jsh_system_config table for unexpected modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a low-privilege tenant account can tamper with critical system settings. This includes altering company identity, changing stock rules, modifying approval workflows, or disrupting printing configurations. The exploit requires only an authenticated session and no admin rights.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized modification of tenant-wide settings including company identity and approval behavior. Such unauthorized changes could lead to violations of data protection regulations like GDPR by exposing or altering personal data handling rules, or HIPAA by compromising healthcare-related configuration integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update jshERP to the latest version beyond 3.6. Implement strict authorization checks in SystemConfigService.updateSystemConfig to validate user privileges. Restrict access to the systemConfig endpoint to administrative users only. Review and audit system configuration changes regularly to detect unauthorized modifications.

Useful 0 Not Useful 0