Skip to content
Threat Feed
Subscribe
high advisory

Privilege Escalation in jshERP 3.6 via updateOneValueByKeyIdAndType

jshERP 3.6 contains an improper access control vulnerability in the updateOneValueByKeyIdAndType endpoint allowing authenticated users to escalate privileges to tenant administrator.

CVE search metadata

CVE search record: CVE-2026-94411. Severity: high. CVSS: 8.8. KEV: no. Product: jshERP (3.6), jshERP (<= 3.6). Brief: Privilege Escalation in jshERP 3.6 via updateOneValueByKeyIdAndType. Brief link: https://feed.craftedsignal.io/briefs/2026-09-jsherp-priv-esc/

What's new

  • 1. added coverage for jshERP (<= 3.6) Sep 21, 20:30 via nvd
  • 2. added coverage for jshERP (<= 3.6) Sep 21, 20:30 via nvd
  • 3. added detection rule: Detects CVE-2026-94412 Exploitation - Password Reset Authorization Bypass Sep 21, 20:30 via nvd

jshERP version 3.6 is vulnerable to a privilege escalation flaw located within the updateOneValueByKeyIdAndType endpoint. This vulnerability stems from improper access control, enabling an authenticated low-privilege tenant user to modify their own account permissions. By submitting a crafted POST request, an attacker can specify the type parameter as UserRole and supply a chosen role ID list, effectively granting themselves administrative privileges within the tenant environment. This vulnerability, tracked as CVE-2026-94411, carries a CVSS v3.1 base score of 8.8. It represents a significant security risk for organizations relying on jshERP for multi-tenant enterprise resource planning, as it allows for horizontal and vertical privilege escalation without requiring existing administrative access.

Impact

Successful exploitation allows a low-privileged tenant user to gain full administrative control over their tenant account. This results in the potential for unauthorized data access, modification, or deletion of sensitive business information and configuration settings stored within the jshERP instance. Given the nature of the application as an ERP system, unauthorized administrative access poses a severe risk to data integrity and business operations.

Recommendation

Prioritize remediation by identifying and patching instances of jshERP 3.6. If a patch is not immediately available, restrict access to the web interface from untrusted networks and audit logs for unauthorized requests to the updateOneValueByKeyIdAndType endpoint.

Detection

Detecting this exploitation requires monitoring web server logs for suspicious POST requests targeting the identified API endpoint.

  • Monitor web access logs for HTTP POST requests to the /updateOneValueByKeyIdAndType endpoint where the request body contains 'type=UserRole' and parameters indicative of role modification.
  • Audit user management activities and privilege changes within the application logs to identify anomalous account elevation events.

Immediate actions

Deploy the Sigma rule for CVE-2026-94411 detection

Detection Engineering 24h

Mitigations

Identify and isolate jshERP 3.6 instances

immediate IT Operations

CVE-2026-94411

Detection coverage 2

Detect CVE-2026-94411 Exploitation - Privilege Escalation in jshERP

high

Detects exploitation of CVE-2026-94411 by monitoring for POST requests to the vulnerable API endpoint with parameters used for privilege escalation.

sigma tactics: privilege_escalation techniques: T1068 sources: webserver

Detects CVE-2026-94412 Exploitation - Password Reset Authorization Bypass

high

Detects potential exploitation attempts against the /user/resetPwd endpoint by monitoring for POST requests that may indicate unauthorized account targeting

sigma tactics: persistence, privilege-escalation techniques: T1531 sources: webserver

Detection queries are available on the platform. Get full rules →