CVE-2026-94501 is a high severity (CVSS 8.8) missing authorization flaw in jshERP through version 3.6. Authenticated users can create, change or delete authorization relation rows through the userBusiness endpoints and escalate privileges. I could not confirm a fixed release, so restrict access and watch the project.
What's affected
The record says jshERP through 3.6 is affected. The weakness is CWE-862, missing authorization. The userBusiness create, update and delete endpoints do not check privileges, so any logged in user can alter the mappings that tie users to roles and roles to functions, for any user in the tenant.
The sources I could read, the repository, the v3.6 controller code and the VulnCheck advisory, do not name a fixed version. Check the repository for releases after 3.6.
This is a sibling of CVE-2026-94412 in the same product. That one resets passwords. This one edits the permission model itself, so the two together give a low privilege user a route to full control. VulnCheck rates it high with a CVSS version 4 score; the record's 8.8 comes from a version 3.1 vector.
How to check if you're exposed
Confirm the jshERP release you run against 3.6.
Then review the permission data. Your database holds the user to role and role to function mappings. Compare the current state with a recent backup and look for new or removed rows that nobody requested, especially for administrator roles.
At the proxy, look for calls to the userBusiness routes from accounts that are not administrators.
grep -i "userBusiness" /var/log/nginx/access.log
What to do now
- Look for a jshERP release later than 3.6 that fixes the userBusiness endpoints and apply it.
- Restrict the userBusiness routes at your reverse proxy to administrator addresses until a fix is available.
- Audit role and permission tables against a backup and restore any change you cannot explain.
- Keep the application off the public internet, behind a VPN or an allowlist.
- Review the accounts that hold administrator access and remove any you do not recognize.
Why it matters
Role and function mappings are the application's access policy stored as data. If any logged in user can write to that data, the policy is only advice. CWE-862 here means the endpoint does the work without asking whether the caller is allowed to.
The damage is both ways. An attacker can grant themselves access, or strip access from others, which makes it a tool for sabotage as well as theft. The record does not mark exploitation and the CVE is not in CISA's catalog, but a public proof of concept is among the references, so assume attackers can reproduce it.
Quick check
How does this relate to CVE-2026-94412?
Same product and versions, different endpoints. One resets passwords. This one edits roles and permissions. Fix or restrict both.
Is a patch available?
I could not confirm one in the sources I read. Check the jshERP repository.
Sources
Last reviewed: 18 October 2026.
