CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in its role management endpoints (/role/update and /role/delete), allowing any authenticated user to modify or delete any role 's data scope. An attacker can escalate privileges by changing a role's data visibility to cover all records, gain...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496: Missing Authorization

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

PT-2026-96209

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description Authenticated users can modify the data scope of any role or delete roles due to a failure in validating caller permissions within role management endpoints. This allows for privilege escalation and the...

CVE-2026-54322

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...

CVE-2026-54322: Authorization Bypass Through User-Controlled Key

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...