Vulnerability · Published Sep 21, 2026 · Assigned by VulnCheck

CVE-2026-94501jshERP through 3.6 Privilege Escalation via userBusiness CRUD

High 8.8

In plain English

A high-severity missing authorization in jshERP from jishenghua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

Affected products (as reported)

Vendor	Product	Versions
jishenghua	jshERP	0 – through 3.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Proof of concept exploit
Vulnerable code technical-description
https://github.com/jishenghua/jshERP product
VulnCheck Advisory: jshERP through 3.6 Privilege Escalation via userBusiness CRUD third-party-advisory