High severity · published Sep 21, 2026
CVE-2026-94496
jshERP through 3.6 Privilege Escalation via Role Management
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
jshERP · jishenghua
through 3.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94496
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94496
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-11-role-tamper.py
github.com
https://github.com/jishenghua/jshERP
github.com
https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/RoleController.java#L76-L98
www.vulncheck.com
https://www.vulncheck.com/advisories/jsherp-through-3.6-privilege-escalation-via-role-management
More from jshERP
9.8
CVE-2026-1546
jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
9.8
CVE-2025-51744
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51742
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51743
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51746
An issue was discovered in jishenghua JSH_ERP 2.3.1