Executive brief
jshERP is an open-source ERP system for small and medium enterprises that manages inventory, sales, purchasing, and financial operations. An authenticated user with any privilege level can modify role definitions and permissions for other users, widening data visibility to all company records or deleting roles entirely, leading to unauthorized access to sensitive business data and potential privilege escalation.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the /role/update and /role/delete endpoints. Any authenticated tenant user can invoke these endpoints to modify the data scope of any role to "all data" or delete roles, bypassing the permission validation that exists in the tenantRoleList method. An attacker with a low-privilege account token can escalate privileges and exfiltrate all business records within the tenant.
Affected products
- jishenghua jshERP through 3.6
Timeline
- 2026-09-21: disclosed