Description

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T19:17:20.800Z",
  "pubdate": "2026-09-21T19:17:20.800Z",
  "executiveSummary": "The jshERP platform, specifically versions up to 3.6, contains a critical Broken Access Control vulnerability residing within the userBusiness/updateBtnStr endpoint. This security flaw stems from an absent authorization validation mechanism when processing POST requests intended to modify role-based button permissions.\nThe vulnerability allows any authenticated user, regardless of their assigned privilege level, to arbitrarily modify button-permission configurations for any role defined within the multi-tenant system. By manipulating the roleId and btnStr parameters, an attacker can escalate privileges by granting themselves administrative UI capabilities or disrupt system operations by removing access for legitimate administrators.\nThe risk is severe as it enables unauthorized modification of the security authorization schema, potentially leading to total compromise of application functionality. Exploitation requires authenticated access to the application, but it does not require administrative privileges, significantly lowering the bar for malicious actors within the system. Immediate remediation is required to ensure that server-side authorization checks are enforced for all state-changing operations.",
  "technicalDetails": "The vulnerability is localized to the server-side processing of the POST /userBusiness/updateBtnStr endpoint. The root cause of the flaw is an Insecure Direct Object Reference (IDOR) pattern compounded by a complete lack of functional access control. Although the system expects the request to be initiated by an authorized administrative user, the backend implementation fails to verify the identity or the permissions of the requester before committing the requested changes to the persistent database storage.\nThe attack vector involves a crafted HTTP POST request directed at the updateBtnStr function. An authenticated user, holding a low-privileged account, can observe the structure of the JSON payload required by the endpoint. The payload specifically includes the roleId, which serves as a target identifier for the permission update, and the btnStr, which represents the serialized definition of permitted interface buttons or actions.\nThe exploitation flow proceeds as follows: First, the attacker authenticates as a standard user. Second, the attacker intercepting traffic or manually crafting a request targets the /userBusiness/updateBtnStr endpoint. Third, the attacker injects an arbitrary target roleId (corresponding to an administrator or any other role) and a modified btnStr string designed to grant elevated UI access. Finally, the server processes the request without validating whether the current session owner possesses the requisite authorization to modify the specified role. Consequently, the backend updates the database record associated with the target roleId.\nThe impact of this successful exploitation includes unauthorized privilege escalation. By overwriting the button-permission configuration, an attacker can force the application to render administrative menus or buttons to their user session that were previously restricted. Conversely, the attacker can execute a Denial of Service (DoS) attack against other users by stripping necessary permissions from their roles, effectively disabling critical business functions. Because the system lacks a secondary authorization check at the logic layer, the application state is permanently altered until the configuration is manually restored by a system administrator. The vulnerability highlights a failure in the application's central authorization enforcement policy, where security relies solely on UI-level hiding rather than robust backend verification."
}