CVE-2026-109185 - jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
CVE ID :CVE-2026-109185 Published : Oct. 12, 2026, 1:17 p.m. | 14 minutes ago Description :jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers...