Threats tagged 'ghsa-7rww-rvpx-33hf'

1 threat

Threats tagged 'ghsa-7rww-rvpx-33hf'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.4	EPSS 0.4%	CVE-2026-94414jshERP · Missing Authorization Medium5.4EPSS 0.4%2026-09-21CVE Database V5CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation. EPSS 0.4%Vulnerability jishenghua #cwe-862 #ghsa-7rww-rvpx-33hf	CVE Database V5	2026-09-21

Showing 1–1 of 1 result