JshERP (<= 3.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jsherp--3.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 21 Sep 2026 20:30:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in jshERP 3.6 via updateOneValueByKeyIdAndTypehttps://feed.craftedsignal.io/briefs/2026-09-jsherp-priv-esc/Mon, 21 Sep 2026 20:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-jsherp-priv-esc/jshERP 3.6 contains an improper access control vulnerability in the updateOneValueByKeyIdAndType endpoint allowing authenticated users to escalate privileges to tenant administrator.jshERP version 3.6 is vulnerable to a privilege escalation flaw located within the updateOneValueByKeyIdAndType endpoint. This vulnerability stems from improper access control, enabling an authenticated low-privilege tenant user to modify their own account permissions. By submitting a crafted POST request, an attacker can specify the type parameter as UserRole and supply a chosen role ID list, effectively granting themselves administrative privileges within the tenant environment. This vulnerability, tracked as CVE-2026-94411, carries a CVSS v3.1 base score of 8.8. It represents a significant security risk for organizations relying on jshERP for multi-tenant enterprise resource planning, as it allows for horizontal and vertical privilege escalation without requiring existing administrative access.

Impact

Successful exploitation allows a low-privileged tenant user to gain full administrative control over their tenant account. This results in the potential for unauthorized data access, modification, or deletion of sensitive business information and configuration settings stored within the jshERP instance. Given the nature of the application as an ERP system, unauthorized administrative access poses a severe risk to data integrity and business operations.

Recommendation

Prioritize remediation by identifying and patching instances of jshERP 3.6. If a patch is not immediately available, restrict access to the web interface from untrusted networks and audit logs for unauthorized requests to the updateOneValueByKeyIdAndType endpoint.

Detection

Detecting this exploitation requires monitoring web server logs for suspicious POST requests targeting the identified API endpoint.

  • Monitor web access logs for HTTP POST requests to the /updateOneValueByKeyIdAndType endpoint where the request body contains 'type=UserRole' and parameters indicative of role modification.
  • Audit user management activities and privilege changes within the application logs to identify anomalous account elevation events.
]]>highadvisoryprivilege-escalationweb-applicationauthorization-bypassidorinsecure-direct-object-reference