CVE-2026-94501

Executive Summary

CVE-2026-94501 is a missing-authorization vulnerability (CWE-862) in jshERP through version 3.6, affecting the userBusiness CRUD endpoints. Any authenticated user — regardless of privilege level — can create, modify, or delete authorization-relation rows without the application enforcing an ownership or role check. Because these rows define user-to-role and role-to-function mappings, an attacker can escalate their own privileges, strip access from other accounts, or rewrite the permission model for every user in the tenant, resulting in a complete compromise of the tenant's access-control plane with a CVSS base score of 8.8.

Technical Analysis

jshERP is an open-source Java-based ERP platform. The vulnerability class is Missing Authorization (CWE-862): the affected CRUD endpoints handling userBusiness records — the objects that associate a user with a business/role context and define which functions that identity may invoke — do not verify that the requesting principal holds the authority required to alter authorization data. The endpoints are reachable by authenticated sessions and perform create, update, and delete operations on these relation rows.

The core defect is the absence of a server-side privilege check (an authorization decision), not a weakness in authentication, input validation, or cryptography. Because the authorization model is data-driven — permissions are stored as relation rows and read at request time — writing to that data directly mutates the effective privilege of any account in the tenant. The trust boundary that should separate "authenticated user" from "administrator who may manage authorization data" is simply not enforced at these endpoints.

The CVSS vector confirms the analyst assessment: network reachable (AV:N), low attack complexity (AC:L), low privileges required (PR:L — any authenticated account), no user interaction (UI:N), scope unchanged (S:U), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The high availability impact is consistent with an attacker deleting authorization rows and locking legitimate users out of the system.

No public proof-of-concept, exploit code, or Nuclei template was available at the time of reporting. No EPSS score has been published by FIRST.org, and the CVE is not listed in CISA KEV. No specific function names, class names, URL paths, or API parameters are provided in the source description; analysis is therefore constrained to the vulnerability class and the named endpoint family (userBusiness CRUD). Any deeper code-level claims would be speculation and are deliberately omitted.

Exploitation Scenarios

The attack chain below is inferred strictly from the vulnerability class (CWE-862, missing authorization on authenticated CRUD endpoints) and the data provided. No public PoC exists.

1. Reconnaissance / target identification. The attacker identifies a reachable jshERP 3.6 deployment (via Shodan or direct discovery) and obtains a valid low-privilege account. Because exploitation requires only an authenticated session (PR:L), a self-registered account, a default/weak credential, or a compromised low-privilege user is sufficient — no administrative access is needed.

2. Triggering the flaw class. The attacker sends authenticated requests (create, update, or delete) to the userBusiness CRUD endpoints with the session of the low-privilege account. The server processes the request without performing an authorization check on whether the caller is permitted to manage authorization-relation rows, so the operation succeeds despite the caller's lack of privilege.

3. Payload / execution. At the vulnerability-class level, the payload is a set of authorization records rather than code: the attacker submits modified or new relation rows that map their own account to a more privileged role, or that remap role-to-function relationships. Because the authorization model reads these rows on subsequent requests, the altered data takes effect immediately for new requests; no code execution on the host is required.

4. Post-exploitation impact. With persisted changes to the authorization data, the attacker escalates their own privileges (e.g., gaining administrative capabilities), strips access from other accounts by deleting or altering their mappings, and rewrites role-function relationships for any user in the tenant. This converts a single low-privilege foothold into full control of the tenant's access-control plane and accomplishes persistence (T1098-style account/authorization manipulation is a natural analog, though not asserted as observed here) by leaving the modified rows in place.

Impact Assessment

Business impact is severe. Because jshERP governs ERP workflows, a compromised authorization plane exposes financial, inventory, and business-process data and permits unauthorized business actions via escalated roles. The affected system is the application server and its backing database; the blast radius is the entire tenant, since the flaw permits modification of authorization relations "for any user in the tenant."

The CVSS subscores map directly to this: confidentiality high (access to data and functions normally reserved for privileged roles), integrity high (permission data and, downstream, business records can be modified), availability high (deleting authorization rows can lock out legitimate users, degrading or denying service to the tenant). Scope is unchanged (S:U) because the vulnerable component and impacted component are the same application. Exploit prerequisites are low — network access plus any valid low-privilege credential — and no user interaction is required, meaning exploitation is repeatable, low-noise, and blendable into normal API traffic.

As of this report: no public exploit code, no Nuclei template, no EPSS score, and no CISA KEV listing. Absence of public exploitation does not lower risk — the vulnerability is trivially automatable by anyone with a valid session, and no vendor patch exists (patch confidence 0/4).

Detection Guidance

Sigma Rule

title: jshERP userBusiness Authorization-Bypass CRUD Activity
id: 8e4b1c2a-3f77-4d2b-9a10-7c5e0f945110
status: experimental
description: Detects authenticated create/modify/delete operations against jshERP userBusiness endpoints, consistent with CVE-2026-94501 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94501
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege-escalation
  - attack.t1078
  - cve.2026-94501
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
  selection_uri:
    cs-uri-stem|contains: 'userBusiness'
  filter_health:
    cs-uri-stem|contains: '/health'
  condition: selection_method and selection_uri and not filter_health
fields:
  - c-ip
  - cs-username
  - cs-method
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate administrator maintenance of authorization relations
level: high

YARA Rule

rule CVE_2026_94501_jshERP_userBusiness_AuthzBypass
{
    meta:
        description = "Detects references to jshERP userBusiness authorization-relation endpoints in web/app logs, consistent with CVE-2026-94501 exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94501"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "userBusiness" ascii nocase wide
        $m1 = "POST" ascii
        $m2 = "PUT" ascii
        $m3 = "DELETE" ascii

    condition:
        $ep1 and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94501 jshERP userBusiness Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"userBusiness"; nocase; http.uri; content:"delete"; nocase; sid:9450110; rev:1; metadata:cve CVE-2026-94501, created_at 2026_01_01; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94501;)
alert http any any -> any any (msg:"CVE-2026-94501 jshERP userBusiness CRUD Modification"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"userBusiness"; nocase; sid:9450111; rev:1; metadata:cve CVE-2026-94501, created_at 2026_01_01; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94501;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method in ("POST","PUT","DELETE")
      and http.request.uri : "*userBusiness*" ]
  [ network where http.request.method in ("POST","PUT","DELETE")
      and http.request.uri : "*userBusiness*"
      and http.response.status_code in (200, 201, 204) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=apache
(http_method=POST OR http_method=PUT OR http_method=DELETE)
uri_path="*userBusiness*"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(http_method) as methods values(status) as statuses
        by src_ip, user
| where count > 0 AND (status >= 200 AND status < 300)
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="jshERP,web,authorization_bypass,">
  <rule id="945101" level="12">
    <decoded_as>json</decoded_as>
    <field name="request_method">POST|PUT|DELETE</field>
    <field name="uri">userBusiness</field>
    <description>CVE-2026-94501: jshERP userBusiness authorization-relation CRUD access (possible privilege escalation)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround has been published.

1. Immediate mitigations

• Restrict network access to the jshERP application so that only trusted administrative networks can reach the userBusiness endpoints; place the application behind an authenticating reverse proxy or VPN where feasible.
• In front of the application (reverse proxy / API gateway / WAF), enforce an authorization policy that blocks non-administrative principals from POST/PUT/DELETE requests targeting the userBusiness endpoint family, and log all such attempts.
• Audit and aggressively remove unused or stale accounts: because exploitation requires only a valid low-privilege session (PR:L), reducing the number of valid credentials directly reduces exposure.
• Monitor continuously for changes to authorization/user-role mapping data and alert on any modification performed by identities that are not known administrators.

2. Patch / upgrade steps

• No patch exists. Track the jshERP project's release channels and the NVD entry for CVE-2026-94501; if the vendor later publishes an authorization fix, validate it in a staging environment and upgrade all instances through the fixed version. Do not assume a fix without a vendor advisory confirming one.

3. Long-term hardening

• Demand server-side authorization checks (not client-side or UI-only) on all endpoints that mutate authorization or identity data; treat permission data as a protected resource.
• Adopt defense-in-depth: least privilege for application database users, application-layer authorization middleware, and change auditing on permission tables.
• Integrate CVE and patch monitoring into vulnerability management so unpatched, high-severity authorization flaws are prioritized for compensating controls.

References

• NVD — CVE-2026-94501: https://nvd.nist.gov/vuln/detail/CVE-2026-94501
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST.org EPSS (no score available for this CVE at time of reporting): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94501 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• jshERP project repository and release notes (track for vendor advisory/patch): https://gitee.com/jishenghua/JSH_ERP

No public exploit code, Nuclei template, or proof-of-concept is known, and no threat-actor campaign or exploit-in-the-wild evidence has been identified for CVE-2026-94501.