Description

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-21T19:17:21.590Z",
  "pubdate": "2026-09-21T19:17:21.590Z",
  "executiveSummary": "jshERP versions through 3.6 are susceptible to a critical Broken Access Control vulnerability residing within the role management module. The flaw stems from a failure to perform server-side permission validation during role update and deletion operations.\nThis vulnerability allows any authenticated user—regardless of their assigned privileges—to interact with restricted administrative endpoints. By manipulating requests to /role/update and /role/delete, an attacker can modify the data scope of existing roles or perform unauthorized deletions.\nThe primary risk implication is a total compromise of the application's authorization model. Successful exploitation enables privilege escalation, allowing attackers to grant themselves or other entities administrative permissions, manipulate data visibility to encompass the entire tenant, and facilitate unauthorized access to sensitive business records. Because the application fails to verify the caller's authorization context, the security boundary between standard users and administrators is effectively eliminated, posing a severe threat to data confidentiality and integrity.",
  "technicalDetails": "The vulnerability is characterized as an Insecure Direct Object Reference (IDOR) and missing function-level access control within the jshERP role management architecture. The application exposes administrative functionality via the /role/update and /role/delete endpoints, which are designed to manage organizational roles, permissions, and data visibility scopes.\nThe root cause of this vulnerability is the absence of robust server-side authorization checks. When a request is sent to the vulnerable endpoints, the application logic proceeds to process the request based solely on the presence of a valid session token, failing to verify whether the authenticated user possesses the 'Administrator' or equivalent role-based access control (RBAC) permissions required to modify or remove security-critical objects.\nThe attack flow follows a predictable pattern of exploitation. An attacker, authenticated with standard user privileges, identifies the target role identifier through client-side API enumeration or observation of existing role management requests. By intercepting and modifying the request body directed at /role/update, the attacker can submit a payload that reconfigures the 'Data Scope' attribute of a role. Setting this scope to 'All Data' overrides existing restrictions, enabling the attacker to bypass organizational segmentation and access records restricted to higher-privilege users.\nFurthermore, the /role/delete endpoint lacks any validation, allowing the attacker to perform mass deletion of roles, effectively leading to a denial-of-service condition or the total breakdown of administrative control. Because the application logic fails to compare the requester’s ID or role permissions against the scope of the operation being performed, the authorization layer is rendered transparent to the attacker.\nPost-exploitation, the impact is comprehensive. By escalating privileges through role modification, the attacker achieves persistence and full administrative control over the jshERP instance. This facilitates lateral movement within the business logic, unauthorized exfiltration of sensitive business intelligence, and the ability to modify or delete audit logs, thereby complicating forensic investigations. The vulnerability does not require complex execution; it merely requires standard authentication and the ability to craft HTTP requests to the identified backend endpoints."
}