CVE-2026-94501

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...

CVE-2026-94501 jshERP through 3.6 Privilege Escalation via userBusiness CRUD

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...

CVE-2026-94501 jshERP through 3.6 Privilege Escalation via userBusiness CRUD

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...

CVE-2026-94501

jshERP through version 3.6 contains an authorization bypass vulnerability in its userBusiness CRUD endpoints . Authenticated users can create, modify, or delete authorization-relation rows without adequate privilege checks, enabling them to manipulate user-role mappings and access controls. This ...