CVE-2026-109185

{
  "etk_id": "ETK-2026-1365",
  "cve_id": "CVE-2026-109185",
  "display_id": "CVE-2026-109185",
  "ghsa_id": "GHSA-jc6r-cm4g-j9v8",
  "euvd_id": "EUVD-2026-97389",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in jshERP role management",
  "summary": "jshERP through 3.6 has an authorization flaw in user role updates. An authenticated user with low privileges may be able to assign elevated roles or modify another tenant user's role. Exploitation requires access to an authenticated account.",
  "mitigation": "Restrict application access to trusted users, enforce least-privilege account assignment, and review role-change activity for unauthorized updates. Apply a vendor-provided update when one becomes available; no fixed version is recorded.",
  "vendor": "jishenghua",
  "product": "jshERP",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "jshERP",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0029,
  "epss_percentile": 0.2021,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 90.8687167,
  "t0_at": "2026-10-12T13:10:44.971000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T13:10:44.971000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T13:10:44.971000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109185"
    }
  }
}