Is CVE-2026-94411 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94411?

CVE-2026-94411 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-94411

Description

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.