CVE-2026-94501

Summary

This vulnerability allows authenticated users to bypass authorization checks and manipulate user-role mappings, leading to potential privilege escalation and access control modifications.

Exploitability

Exploitation requires an authenticated user with access to the userBusiness CRUD endpoints. The vulnerability is relatively easy to exploit given the preconditions.

Blast radius

If exploited, attackers can escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant, leading to significant damage.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to jshERP 3.61 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.