CVE-2026-94501

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7

Description An authorization bypass exists in the userBusiness CRUD endpoints. This issue allows authenticated users to create, modify, or delete authorization-relation rows because the system fails to perform necessary privilege checks. An attacker can exploit this to manipulate user-role mappings and access controls, enabling them to escalate privileges, remove access from other accounts, or modify role-function relationships for any user within the tenant.

Recommendations Update jshERP to version 3.7 or later. Restrict access to the userBusiness CRUD endpoints to only authorized administrative accounts as a temporary mitigation.