Description

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T19:17:20.067Z",
  "pubdate": "2026-09-21T19:17:20.067Z",
  "executiveSummary": "jshERP version 3.6 is susceptible to an insecure access control vulnerability within its role management functionality.\nThe vulnerability exists in the updateOneValueByKeyIdAndType endpoint, which fails to properly validate the authorization of the requesting user when modifying security roles.\nThis flaw allows a low-privilege tenant user to manipulate their own account permissions by sending a crafted POST request, effectively assigning themselves an arbitrary set of role IDs.\nThe impact is significant, enabling unauthorized privilege escalation to tenant administrator status, granting full control over tenant-specific data and administrative functions.\nExploitation requires an existing authenticated session as a low-privilege user; no further interaction is necessary to achieve the escalation.\nThe vulnerability represents a failure in server-side authorization checks, where the application trusts user-supplied parameters to define user-role mappings without verifying if the authenticated requester possesses the authority to perform such modifications.",
  "technicalDetails": "The vulnerability is located in the updateOneValueByKeyIdAndType endpoint of jshERP 3.6. This function is designed to handle key-value updates within the application's configuration or user management schemas, specifically when handling the UserRole type.\nThe root cause is a lack of authorization verification (Access Control Bypass) within the server-side code handling the request. While the endpoint requires a valid session token, it fails to perform a secondary check to confirm whether the user associated with that session has the requisite 'administrator' or 'SuperUser' privileges to modify role assignments.\nWhen an attacker initiates a POST request to this endpoint, they provide parameters including 'type' set to 'UserRole', their own unique user ID, and an array of target role IDs. The backend processes this request by updating the database mapping between the user and the specified roles without validating the caller's authority to grant those roles.\nThe attack flow follows these steps: 1) The attacker authenticates as a low-privileged tenant user. 2) The attacker crafts a POST request targeting the updateOneValueByKeyIdAndType function. 3) Within the request body, the attacker specifies the 'UserRole' type and injects their own user ID alongside high-privilege role identifiers (e.g., Tenant Administrator). 4) The application processes the update instruction, writing the new authorization level to the persistence layer. 5) Upon the next authentication cycle or session update, the user's privilege context is upgraded to reflect the newly acquired administrative roles.\nThis vulnerability is particularly dangerous as it allows horizontal or vertical movement within the tenant structure. Because the application logic relies on the database-level association between UserID and RoleID, the successful execution of this request effectively overwrites existing security policies for the attacker's account. The exposure is limited to authenticated users; however, the lack of input validation regarding the requester's authority essentially nullifies the Role-Based Access Control (RBAC) model implemented in the system.\nPost-exploitation, the attacker gains full administrative control over the tenant instance. This encompasses the ability to view, modify, or delete sensitive business data, manage other users, and configure application settings, resulting in a complete compromise of the tenant's security domain."
}