CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in its role management endpoints (/role/update and /role/delete), allowing any authenticated user to modify or delete any role 's data scope. An attacker can escalate privileges by changing a role's data visibility to cover all records, gain...

CVE-2026-54322

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...