CVE-2026-94501 is a CWE-862 Missing Authorization vulnerability affecting jshERP through version 3.6. The flaw exists in the userBusiness CRUD endpoints, where authenticated users can bypass authorization controls to create, modify, or delete authorization-relation rows without appropriate privilege verification. This enables attackers to alter user-role mappings and access controls, facilitating privilege escalation or unauthorized changes to role-function relationships for any user in the tenant.

The vulnerability allows authenticated users to bypass authorization checks, leading to high-impact consequences including full confidentiality, integrity, and availability compromise within the affected tenant. Attackers can escalate privileges, revoke access from other users, or alter role-function mappings, severely undermining access control mechanisms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious activity related to user-role management.