An authorization bypass vulnerability in jshERP 3.6 and earlier allows authenticated attackers to escalate privileges or disrupt access controls by manipulating user-role mappings.

The application fails to perform adequate capability checks on the userBusiness CRUD endpoints (CWE-862). Any authenticated user can interact with these endpoints to create, modify, or delete authorization-relation records, effectively allowing unauthorized administrative control over tenant access policies.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for impact on confidentiality, integrity, and availability. A successful exploit enables a low-privilege user to escalate their own privileges, revoke access for legitimate administrators, or compromise the entire tenant security model. This could lead to total loss of data control and significant operational disruption within the ERP environment.

Immediate Action: As no specific patch version is currently identified, verify if the vendor has released a security update for the jshERP-boot module. If an update is unavailable, restrict network access to the jshERP management interface to trusted administrative subnets only.

Proactive Monitoring: Review application access logs for suspicious activity targeting the /userBusiness/add, /userBusiness/update, and /userBusiness/delete endpoints. Monitor for unexpected modifications to user-role mappings or authorization-relation rows.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests to the vulnerable /userBusiness/ endpoints that do not originate from authorized administrative sessions or known IP ranges.

Public Exploit Available: Yes, a functional proof-of-concept script has been published on GitHub.

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability poses a significant risk to organizational integrity. Administrators should prioritize restricting access to the affected ERP endpoints and monitor for any signs of unauthorized privilege changes until an official vendor patch is applied.