CVE-2026-94411

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

  • Published Sep 21, 2026
  • CVSS 8.7 high
  • 0.5% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-94411 at the National Vulnerability Database