CVE-2026-94501
Received Received - Intake

Authorization Bypass in jshERP via UserBusiness CRUD Endpoints

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94501
EUVD
EUVD-2026-84049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jsherp jsherp to 3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

jshERP through version 3.6 has a missing authorization check in the userBusiness CRUD endpoints. This allows authenticated users to create, modify, or delete authorization-relation rows without proper privilege validation. Attackers can manipulate user-role mappings and access controls to escalate their own privileges or remove access from other accounts.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to the jsh_user_business table in jshERP. Use database queries to review recent changes to user-role mappings or authorization relations. The provided PoC script can be used in dry-run mode to test for the vulnerability without making changes.

Impact Analysis

An attacker with low-privilege access could escalate their privileges to gain higher-level permissions. They could also strip access from other users, disrupt tenant access controls, or modify role-function relationships for any user within the tenant. This could lead to unauthorized data access, system control, or denial of service.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications, or loss of access controls, all of which are compliance violations under these regulations.

Mitigation Strategies

Immediately update jshERP to the latest version beyond 3.6. Apply strict input validation and enforce proper authorization checks in all CRUD endpoints. Review and audit user-role mappings and authorization relations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart