CVE-2026-94496

HighCVSS 8.3/10Last modified Sep 22, 2026

Description

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-944978.3jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authentica CVE-2026-944986.5Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-944997.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94506.3A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.ph CVE-2026-945006.5Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.CVE-2026-945018.8jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to crea CVE-2026-945027.5In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote CVE-2026-9450310.0Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue CVE-2026-945047.2Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An CVE-2026-945058.1The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all version CVE-2026-945066.5Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.CVE-2026-94516.3A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality o