EUVD-2026-97389
GHSA-jc6r-cm4g-j9v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege tenant user
-
ExploitSend crafted PUT to updateUser with own id and admin roleId
-
ExecutionMissing authorization check grants admin role
-
ImpactOperate with tenant administrator privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated jshERP account of any privilege level (PR:L) that can reach the UserController updateUser (PUT user) endpoint; no user interaction or special non-default configuration is indicated. The attacker supplies a user id (their own or another tenant user's) together with a tenant administrator roleId, and the handler performs no authorization check binding the role change to the caller's privileges. The primary limiting factor is obtaining an initial low-privilege account; versions are limited to jshERP through 3.6. |
| Impact | This is a genuine priority, not a high-CVSS-but-low-real-risk issue, though it requires a valid low-privilege account first. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) confined to the vulnerable system (SC:N/SI:N/SA:N), consistent with CWE-862 Missing Authorization. Publicly available exploit code exists (a Python POC referenced in the input), which raises real-world risk by lowering the skill barrier; this is confirmed exploit availability and must not be conflated with active exploitation. The vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of confirmed active exploitation or a quantified exploitation probability - treat the practical threat as elevated due to POC existence but unconfirmed in-the-wild use. The signals are consistent rather than conflicting: the PR:L requirement (any authenticated tenant user) aligns with the description's 'authenticated users' and 'low-privilege attackers,' meaning the main limiting factor is obtaining any foothold account on a jshERP instance. |
| Exploit ScenarioDerived | A low-privilege user with a valid jshERP account (or self-registered/tenant user) sends a crafted PUT request to the updateUser endpoint supplying their own user id together with a tenant administrator roleId, which the UserController fails to authorize against the caller's privileges. A public Python POC (poc_identity_privilege_write.py) demonstrates this, letting the attacker grant themselves admin roles or rebind other tenant users' roles over the network with low attack complexity and no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Privilege escalation in jshERP through 3.6 allows any authenticated user, including one holding only minimal privileges, to assign themselves or any other user within the tenant the administrator role through the UserController updateUser (PUT user) handler, which performs no authorization check tying the role change to the caller's own privileges. An attacker sends their own user id together with a tenant administrator roleId (or rebinds another tenant user's role) and obtains full administrative control over business, financial, and user data managed by the platform. Publicly available exploit code exists as a Python proof-of-concept, and with a CVSS 4.0 base score of 8.7 (independently scored 8.7 under CVSS 3.1) the only meaningful precondition is possession of a valid low-privilege jshERP account; no user interaction or non-default configuration is required.
RemediationAI
No vendor-released patch identified at time of analysis; jshERP 3.6 is the latest referenced version and no fixed release version is provided in the available intelligence, so remediation must currently rely on compensating controls. The most direct control is to enforce authorization at the server edge: deploy a reverse-proxy or WAF rule on /user/updateUser (PUT) that only allows requests carrying an administrator session or, where the deployment permits it, block the endpoint entirely - the trade-off is that legitimate user administration via the UI will break and must be routed through a privileged administrative path or performed directly in the database. Second, restrict network access to the jshERP management interface (VPN or IP allowlisting for administrative subnets), accepting the operational cost of reduced remote accessibility for normal business users. Third, if the codebase can be modified, add an explicit authorization check in UserController.updateUser/UserService that binds the target user id and the requested roleId to the caller's own tenant and role hierarchy before persisting the change; this is the only durable fix and must be re-applied to every future upstream upgrade. Fourth, limit the attack surface by disabling or tightly controlling self-registration and by auditing existing accounts, since the exploit depends on obtaining any valid low-privilege account. Finally, enable and monitor audit logging on role-change operations and alert on any roleId assignment to an administrator role originating from a non-administrative session, which detects exploitation attempts that slip past the above controls. Reference the VulnCheck advisory and the public proof-of-concept at https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py to validate that the controls actually block the request pattern.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jshERP is a Java Spring Boot-based open-source ERP/business management platform (the vulnerable module is jshERP-boot), exposing RESTful endpoints that manage users, roles, and permission assignments. The defect is classified as CWE-862 (Missing Authorization) and resides in the UserController.updateUser handler (source lines 342-350 of UserController.java) together with the corresponding logic in UserService.java (lines 679-709). The handler accepts a user object containing an id and a roleId and persists the role change without verifying that the caller is permitted to modify that particular user or to grant that particular role - there is no ownership check, no tenant-boundary check, and no role-hierarchy check. Because roleId is attacker-controlled input, a low-privilege authenticated principal can point it at the tenant administrator role and elevate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network reachability, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact, which is consistent with the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable pattern is a classic broken function-level authorization failure in a state-changing administrative endpoint.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network endpoint reachable by any authenticated user so AV:N/AC:L/PR:L/UI:N; gaining tenant admin yields full data read, modification, and disruption so C/I/A:H, no scope change (S:U).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
Technical POC Analysis
CWE-862 (Missing Authorization) in jshERP's user identity module.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
jshERP versions through 3.6 contain a privilege escalation vulnerability that allows any user with a valid low-privilege account to grant themselves or others administrative rights, leading to full control over business, financial, and user data. Organizations running jshERP are at risk of data breaches, fraud, or operational disruption, and leadership should prioritize mitigation because public exploit code exists and no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to jshERP, enforcing least privilege, auditing user roles for unauthorized changes, temporarily disabling the PUT user endpoint if not required, and implementing custom authorization checks. Monitoring for exploit attempts is critical given public exploit code exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB