CVE-2026-94414

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description An authorization check is missing on the 'POST /userBusiness/updateBtnStr' endpoint, allowing authenticated users to modify role button-permission definitions. An attacker can provide arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role within the tenant without proper privilege validation.

Recommendations Update jshERP to version 3.7 or later. As a temporary mitigation, restrict access to the 'POST /userBusiness/updateBtnStr' endpoint.