Description

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T13:17:31.840Z",
  "pubdate": "2026-10-12T13:17:31.840Z",
  "executiveSummary": "jshERP versions up to 3.6 are susceptible to an improper authorization vulnerability within the UserController updateUser handler, which permits unauthorized privilege escalation. The vulnerability arises from insufficient server-side validation of authorization tokens or roles during user profile update operations.\nThe flaw allows an authenticated, low-privileged user to modify their own account profile or target other users within the same tenant environment to assign arbitrary roles, including the tenant administrator role.\nThe potential impact includes full administrative compromise of individual tenant accounts, unauthorized data access, and the ability to manipulate organizational settings. Exploitation requires the attacker to be an authenticated user within the system. The vulnerability poses a significant risk to the integrity and confidentiality of the jshERP platform, as it undermines the access control mechanisms enforced by the application's role-based access control (RBAC) model.",
  "technicalDetails": "The vulnerability resides in the UserController component of jshERP, specifically within the updateUser function. The root cause is a failure to implement robust server-side authorization checks that verify if the authenticated user performing the update request possesses the requisite privileges to modify role assignments or user-level permissions.\nThe application relies on client-provided input to process update operations without adequately sanitizing or validating whether the parameters—specifically the roleId field—are authorized for the user associated with the session. An attacker can intercept the request sent to the updateUser endpoint and inject a target roleId, such as that associated with a tenant administrator.\nThe attack flow proceeds as follows: First, the attacker authenticates as a standard user within the jshERP environment. Second, the attacker triggers an update profile request to the UserController. Third, the attacker modifies the HTTP request body to include their own userId or the userId of another tenant member, while appending the malicious roleId parameter representing an administrative privilege. Fourth, the server processes the updateUser handler, which, due to the lack of restrictive authorization logic, updates the database entry for the specified user with the elevated role permissions.\nBecause the server assumes that any incoming request from an authenticated session is implicitly authorized to perform these modifications, the application fails to enforce the principle of least privilege. This lack of access control validation enables vertical privilege escalation, where a low-privileged user can grant themselves or others elevated administrative capabilities.\nPost-exploitation, the attacker gains the permissions associated with the escalated role, providing full administrative control over the targeted tenant. This includes, but is not limited to, the ability to manage other users, access sensitive business records, modify system configurations, and perform unauthorized data exfiltration. The vulnerability persists across all versions of jshERP up to 3.6, necessitating a comprehensive review and enforcement of server-side authorization logic for all sensitive API endpoints."
}