CVE-2026-94496

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description Authenticated users can modify the data scope of any role or delete roles due to a failure in validating caller permissions within role management endpoints. This allows for privilege escalation and the ability to change data visibility to all data, granting access to all business records within the tenant. The issue affects the '/role/update' and '/role/delete' endpoints.

Recommendations Update jshERP to version 3.7 or later. As a temporary mitigation, restrict access to the '/role/update' and '/role/delete' endpoints.