CVE-2026-94411

Executive Summary

jshERP 3.6 contains an authenticated privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint. Any authenticated low-privilege tenant user can send a crafted POST request specifying type=UserRole, their own user ID, and a list of role IDs — including the tenant administrator role ID — to grant themselves administrative privileges. Successful exploitation grants full control over the tenant, exposing all tenant data, financial records, and user management functions, with a CVSS score of 8.8.

Technical Analysis

The vulnerability is a missing authorization check (CWE-862) in the updateOneValueByKeyIdAndType endpoint of jshERP 3.6. The endpoint accepts a type parameter and, when set to UserRole, processes a user ID and a role ID list. The core flaw is that the endpoint does not verify whether the requesting user has the authority to modify role assignments for the specified user ID. Because the endpoint does not enforce role-based access control on the UserRole type operation, an attacker who is authenticated as an ordinary tenant user can supply their own user ID (keyId) and a role ID list that includes the tenant administrator role ID. The server then persists this role assignment, effectively elevating the attacker's privileges to tenant administrator.

Attack surface: The endpoint is network-accessible (CVSS AV:N) and requires only low privileges (PR:L) — a valid low-privilege tenant account. No user interaction (UI:N) is required. The missing authorization check is the sole barrier that should have prevented this action; its absence makes exploitation trivial and deterministic.

No public proof-of-concept or exploit code is available. The attack chain below is inferred at the vulnerability-class level (missing authorization / improper access control) based strictly on the NVD description, which explicitly identifies the endpoint name, the type=UserRole parameter value, the user ID field, and the role ID list parameter behavior. No further implementation details (function names, file paths, internal methods) are available in the supplied data and none are fabricated here.

Exploitation Scenarios

1. Reconnaissance / target identification: The attacker identifies a jshERP 3.6 instance (e.g., via Shodan http.html:"jshERP" or known deployment fingerprints) and obtains a valid low-privilege tenant user account. This could be a self-registered account, a legitimate low-privilege employee account, or a compromised credential. The only prerequisite is authenticated access with low privileges.

2. Triggering the flaw class (missing authorization): The attacker locates the updateOneValueByKeyIdAndType endpoint. Because the endpoint lacks an authorization check on the UserRole operation, the attacker does not need any elevated privileges to invoke it — low-privilege authentication is sufficient. The vulnerability class is broken access control (CWE-862), specifically missing function-level authorization.

3. Payload / execution method: The attacker sends a POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID as the key identifier, and a role ID list containing the tenant administrator role ID. The server processes the request and updates the role assignment for the attacker's user ID. No specific JSON/body schema beyond the documented parameters (type=UserRole, user ID, role ID list) is available; the attack is performed at the endpoint-parameter level as described by NVD.

4. Post-exploitation impact: Upon success, the attacker's account is now a tenant administrator. This grants full administrative control over the tenant: read/write access to all tenant business data, user account management, configuration changes, and potential lateral movement within the tenant. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H) because an administrator can exfiltrate, alter, or destroy tenant data and disrupt services.

Impact Assessment

• CVSS 8.8 (High): AV:N (network exploitable), AC:L (no special conditions), PR:L (requires low-privilege authenticated account), UI:N (no user interaction), S:U (scope unchanged), C:H/I:H/A:H (high confidentiality, integrity, and availability impact).
• Business impact: Complete compromise of the tenant boundary. An attacker can access all financial, inventory, and customer records managed within the tenant, modify or delete business data, create or disable user accounts, and potentially pivot to other integrated systems. In multi-tenant deployments, the blast radius is limited to the attacker's tenant (scope unchanged), but within that tenant the impact is total.
• Affected systems: Any jshERP 3.6 deployment with the updateOneValueByKeyIdAndType endpoint exposed and reachable by authenticated users.
• Blast radius: Single tenant per exploitation, but the low barrier (any authenticated user) makes it a severe insider-risk and credential-compromise amplifier.

Detection Guidance

Sigma Rule

title: jshERP Privilege Escalation via updateOneValueByKeyIdAndType
id: 8f3a1c2e-7b4d-4e9a-9c1f-2d5e6a7b8c9d
status: experimental
description: Detects POST requests to the jshERP updateOneValueByKeyIdAndType endpoint with type=UserRole indicating an attempt to escalate privileges by assigning roles.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94411
author: Threat Intelligence
date: 2025-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.94411
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: 'updateOneValueByKeyIdAndType'
  selection_type:
    cs-uri-query|contains: 'type=UserRole'
    # or body field if logged
  condition: selection_endpoint and selection_type
falsepositives:
  - Legitimate administrative role assignments by authorized administrators (baseline required)
level: high

YARA Rule

rule CVE_2026_94411_jshERP_PrivEsc
{
    meta:
        description = "Detects jshERP privilege escalation requests targeting updateOneValueByKeyIdAndType with type=UserRole"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94411"
        date = "2025-01-01"
        severity = "high"

    strings:
        $ep = "updateOneValueByKeyIdAndType" ascii wide nocase
        $t1 = "type=UserRole" ascii wide nocase
        $t2 = "\"type\":\"UserRole\"" ascii wide nocase
        $t3 = "UserRole" ascii wide nocase
        $role = "roleId" ascii wide nocase

    condition:
        $ep and (any of ($t1, $t2, $t3)) and $role
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94411 jshERP Privilege Escalation Attempt (updateOneValueByKeyIdAndType type=UserRole)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"updateOneValueByKeyIdAndType"; nocase; http.request_body; content:"type=UserRole"; nocase; http.request_body; content:"roleId"; nocase; classtype:attempted-privileges; reference:cve,2026-94411; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94411; sid:202694411; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ network where http.request.method == "POST"
      and url.path contains "updateOneValueByKeyIdAndType"
      and http.request.body contains "type=UserRole" ]
  [ network where http.request.method == "POST"
      and url.path contains "updateOneValueByKeyIdAndType"
      and http.request.body contains "roleId" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=jshERP
| search method=POST uri_path="*updateOneValueByKeyIdAndType*"
| eval body_check = if(match(_raw, "(?i)type=UserRole") AND match(_raw, "(?i)roleId"), 1, 0)
| where body_check=1
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by user, uri_path, status
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="jshERP,web,attack,">
  <rule id="20269411" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">updateOneValueByKeyIdAndType</field>
    <field name="body" type="pcre2">type=UserRole</field>
    <description>CVE-2026-94411: jshERP privilege escalation attempt - updateOneValueByKeyIdAndType with type=UserRole</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the jshERP updateOneValueByKeyIdAndType endpoint to trusted administrative roles at the reverse-proxy/WAF layer.
   • Implement a temporary authorization gate: audit all requests where type=UserRole and reject any role assignment where the requesting user's ID equals the target user ID unless the requester already holds tenant administrator privileges.
   • Monitor for anomalous role ID assignments, especially self-assignment of administrator role IDs by low-privilege accounts.
   • Apply least-privilege principles to tenant accounts: avoid granting low-privilege accounts the ability to reach administrative API routes.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Monitor the jshERP project channels for a security release addressing CWE-862 in this endpoint.
   • When a patch becomes available, upgrade immediately and verify the updateOneValueByKeyIdAndType endpoint enforces role-based authorization before persisting UserRole changes.
   • Where custom code is maintained, add an explicit authorization check ensuring the caller holds permission to modify role assignments and cannot self-assign roles above their own privilege level.

3. Long-term hardening:

   • Enforce server-side authorization checks on every state-changing endpoint; do not rely on client-side controls.
   • Adopt a deny-by-default authorization model for administrative functions.
   • Implement role-assignment monitoring and alerting for privilege changes.
   • Conduct regular access-control reviews and secure-code training focused on CWE-862 (missing authorization).

References

• NVD — CVE-2026-94411: https://nvd.nist.gov/vuln/detail/CVE-2026-94411
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• jshERP project repository (vendor upstream): https://github.com/jshERP
• CISA KEV Catalog (CVE-2026-94411 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified at the time of writing. No public PoC is available.