Authorization Bypass in jshERP UserController

jshERP versions up to and including 3.6 are vulnerable to a missing authorization flaw located within the UserController updateUser handler. This vulnerability enables an authenticated user to perform unauthorized privilege escalation by manipulating role assignments via the application API. Specifically, an attacker can submit a request containing their own user identifier paired with the role ID corresponding to a tenant administrator. Furthermore, the flaw permits the rebinding of roles for other users within the same tenant. Because this vulnerability facilitates horizontal and vertical privilege escalation, it represents a significant security risk for multi-tenant environments where role-based access control is the primary mechanism for security boundary enforcement. Defenders should investigate audit logs related to user role updates to identify potential abuse of this endpoint.

Impact

Successful exploitation allows a low-privilege attacker to gain tenant administrator access, leading to full control over the affected tenant's data and configuration within the jshERP platform. In multi-tenant deployments, this compromise can lead to data exfiltration or unauthorized management of other users' accounts, undermining the integrity of the entire application deployment.

Recommendation

• Identify all instances of jshERP version 3.6 or earlier in the environment.
• Monitor web application logs for POST or PUT requests directed at the UserController updateUser endpoint that indicate privilege changes for user IDs.
• Implement strict server-side authorization checks on all calls to the updateUser handler to ensure the requesting user has the appropriate administrative permissions before modifying roles.