Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-21 | 1 | Disclosure1 |
| 2026-10-14 | 1 | Patch1 |
CVE-2026-94411 jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary ro… https://www.cve.org/CVERecord?id=CVE-2026-94411
Post summary
The text announces CVE-2026-94411, a privilege escalation vulnerability in jshERP 3.6, and provides specific technical details about the affected endpoint and its impact on authenticated users.
CVE-2026-94411 jshERP 3.6 privilege escalation, CVSS 8.8. Any authenticated user can POST to updateOneValueByKeyIdAndType and self-assign admin roles. No patch yet. Restrict endpoint access now. https://www.valtersit.com/cve/CVE-2026-94411 #CVE #infosec #jshERP #jshERP #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text discloses CVE-2026-94411 in jshERP 3.6 with technical details and CVSS 8.8, and recommends a workaround (restrict endpoint access) since no patch is available yet.