jshERP: Missing authorization allows privilege escalation via user update

Summary

jshERP up to and including version 3.6 does not check authorization in the user update handler (UserController updateUser). An authenticated user with low privileges can send their own user ID together with the roleId of the tenant administrator role and thereby gain administrator rights, or change the role assignments of other users in the same tenant. The issue stays within one tenant, but it gives full control over that tenant's data. A public proof-of-concept is referenced; CISA SSVC lists exploitation as none and automation as not possible.

Affected

• jshERP versions 0 to and including 3.6
• Upstream repository: https://github.com/jishenghua/jshERP

Fixed in

Unknown. No vendor advisory or fixed version found.

Workaround

• No vendor workaround published.
• Restrict access to jshERP with a VPN or IP allowlist and remove direct internet exposure where possible.
• Test any proxy-level restriction on the user update endpoint before deploying, as it may break legitimate admin functions.

Exploitation

• Authentication with any valid user account is required; no user interaction is needed.
• A public proof-of-concept is referenced in the CVE record. Its content was not reviewed.
• No evidence of in-the-wild exploitation found; not listed in KEV.
• EPSS 0.00289.

Our recommendation

• Confirm whether any jshERP instance runs version 3.6 or earlier, including test and legacy systems.
• Restrict network access to jshERP and remove it from direct internet exposure if possible.
• Audit user accounts and role assignments, especially the tenant administrator role, and remove unused accounts.
• Review application logs for user update requests that changed roles.
• If compromise is suspected, rotate administrator credentials and review all tenant users.
• Monitor the upstream repository and vendor for a fixed release and apply it as soon as available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Proof of concept (GitHub) github.com
• Vulnerable code: UserController.java (upstream commit 8f28e7c) github.com
• Vulnerable code: UserService.java (upstream commit 8f28e7c) github.com
• Vulners CVE-2026-109185 vulners.com
• OSV CVE-2026-109185 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:56.