https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T14:06:40.459695+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-94496 CVE-2026-94496 — jshERP through 3.6 Privilege Escalation via Role Management 2026-10-01T14:06:41.579265+00:00

Affected: jishenghua jshERP

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.