Description

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T19:17:21.910Z",
  "pubdate": "2026-09-21T19:17:21.910Z",
  "executiveSummary": "jshERP through 3.6 is affected by an authorization bypass vulnerability within its userBusiness CRUD endpoints. This flaw stems from a critical failure in the application's access control mechanisms, which omit mandatory privilege verification during create, update, and delete operations on authorization-relation data.\nThe vulnerability allows an authenticated user to perform unauthorized administrative actions, specifically the manipulation of user-role mappings and internal access control configurations. By exploiting this flaw, an attacker can escalate their own privileges, revoke access rights from other users, or reconfigure the security posture of any tenant within the system.\nThis represents a significant security risk, as it permits unauthorized users to bypass the principle of least privilege, potentially leading to a complete compromise of the authorization model. Successful exploitation requires the attacker to have basic authenticated access to the application; no elevated privileges are required to initiate the attack. The lack of server-side validation on these endpoints enables an attacker to manipulate the integrity of the role-based access control (RBAC) schema, effectively undermining the software's security enforcement layer.",
  "technicalDetails": "The vulnerability is localized within the 'userBusiness' CRUD (Create, Read, Update, Delete) controller endpoints of jshERP version 3.6 and earlier. The root cause is an insecure implementation of the authorization layer where the backend logic fails to validate the current user's security context before processing data modification requests related to user authorization mappings.\nSpecifically, the application logic assumes that any request directed at these endpoints is authorized, neglecting to perform a mandatory permission check against the active session's roles or assigned functions. This allows an attacker to interact directly with the underlying database tables responsible for mapping users to roles and functions.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate authenticated session within the jshERP platform. Second, the attacker targets the 'userBusiness' API endpoints, constructing crafted HTTP requests (POST, PUT, or DELETE) designed to modify authorization-relation rows. Since the server-side code does not perform an authorization check, the request is processed by the application controller as a legitimate administrative action.\nBy submitting these requests, the attacker can manipulate the user-role mapping tables. For example, by inserting a new record, an attacker can elevate their own account privileges by assigning themselves a role associated with administrative functions. Alternatively, an attacker can modify existing rows to strip access from other users, effectively performing a denial-of-service attack on legitimate user access or disrupting business operations by altering the function-role relationships globally across the tenant.\nThe impact of this exploit is severe, as it grants unauthorized control over the system's internal security configuration. Because the manipulation occurs at the application layer, the changes are persisted to the backend database, leading to a lasting impact on the environment's security. The vulnerability highlights a failure in the application's design to strictly enforce authorization checks on sensitive administrative endpoints, allowing low-privileged users to assume the capabilities of an administrator or modify the global security policy."
}