Executive brief
jshERP is an open-source ERP system for small and medium enterprises that manages inventory, sales, procurement, and financial operations. An authenticated low-privilege user can exploit a broken authorization flaw in the updateOneValueByKeyIdAndType endpoint to grant themselves arbitrary administrative roles, escalating from a limited tenant user to a tenant administrator with full system access.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the POST /userBusiness/updateOneValueByKeyIdAndType endpoint that allows an authenticated user to modify their own UserRole record. An attacker with any valid tenant user credential can send a request with type=UserRole, their own user ID, and a target role ID list to self-escalate privileges. The endpoint fails to validate that the requester should not be able to modify their own role assignments, allowing direct privilege elevation from low-privilege to administrator.
Affected products
- jishenghua jshERP 3.6
Timeline
- 2026-09-21: disclosed