A high-severity privilege escalation vulnerability in jshERP 3.6 allows authenticated users to elevate their privileges to tenant administrator, posing a critical risk to system integrity.

This flaw exists due to missing authorization checks in the updateOneValueByKeyIdAndType endpoint. An authenticated user can send a malicious POST request to modify their own user role assignments, effectively bypassing intended access controls.

Successful exploitation allows a low-privileged tenant user to gain administrative control over the application. This result leads to complete compromise of the tenant environment, including unauthorized access to sensitive data, modification of system configurations, and potential disruption of business operations. The CVSS score of 8.8 reflects the high severity of this unauthorized privilege acquisition.

Immediate Action: As no official patch is currently available, administrators should restrict access to the jshERP instance to trusted networks and monitor user account activity for anomalous role changes.

Proactive Monitoring: Security teams should audit logs for POST requests directed at the updateOneValueByKeyIdAndType endpoint, specifically looking for modifications involving the UserRole type.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block POST requests to /userBusiness/updateOneValueByKeyIdAndType that contain unauthorized role ID modifications in the payload.

Public Exploit Available: Yes, a functional proof-of-concept script is available via the researcher's GitHub repository.

Given the ease of exploiting this privilege escalation, administrators must treat this as a critical priority. Until a vendor-supplied patch is released, ensure that only authorized personnel can access the application, and consider implementing strict network-level segmentation to limit the exposure of the management interface. Applying the recommended WAF rules is essential to prevent unauthorized role elevation.