A critical access control vulnerability in jshERP v3.5 allows unauthorized attackers to manipulate sensitive system data, posing a significant risk to application integrity.

The vulnerability exists within the RoleController.java component, which fails to properly validate user permissions. This allows an unauthenticated attacker to perform unauthorized modifications to supplier statuses across the platform.

The ability for an unauthorized party to modify supplier statuses can lead to severe operational disruption, supply chain compromise, and unauthorized alteration of business records. With a CVSS score of 8.8, this vulnerability represents a high risk to business operations, as it facilitates unauthorized administrative actions that could be used to facilitate further fraud or data manipulation.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official project repository for security updates and restrict network access to the jshERP instance to trusted IP addresses only.

Proactive Monitoring: Review web server and application access logs for suspicious requests targeting the RoleController endpoint or unexpected modifications to supplier records.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the RoleController component and monitor for anomalous traffic patterns.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's repository.

Given the severity of the access control failure and the existence of a public proof-of-concept, organizations running jshERP v3.5 should prioritize limiting exposure of the application to the public internet. Organizations must maintain vigilance for official vendor patches and apply them immediately upon release to remediate this high-risk vulnerability.