A critical authorization vulnerability in jshERP allows authenticated users to escalate privileges and access unauthorized business data, posing a severe risk to tenant confidentiality.

The application suffers from a missing authorization flaw (CWE-862) within the /role/update and /role/delete endpoints. Because the RoleController lacks proper permission validation, any authenticated user can manipulate role definitions to gain unauthorized visibility into all business records.

Successful exploitation grants an attacker the ability to bypass intended access controls, leading to the unauthorized disclosure of sensitive business information across the entire tenant. Given the CVSS score of 8.3, this high-severity vulnerability represents a significant threat to data integrity and organizational compliance, as it effectively nullifies the role-based access control model of the ERP system.

Immediate Action: Since no official patch is currently available, restrict access to the jshERP management interface to trusted administrative networks only.

Proactive Monitoring: Review application access logs for unusual activity involving the /role/update and /role/delete endpoints, particularly from non-administrative user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized or suspicious requests directed at the /role/ controller endpoints until a vendor-supplied update is implemented.

Public Exploit Available: Yes, a proof-of-concept script is available via the researcher's GitHub repository.

This vulnerability presents a high risk due to the potential for complete loss of data confidentiality within the ERP environment. Administrators should treat this as a priority and implement strict network-level access controls immediately while awaiting a formal security update from the vendor.