Threats tagged 'ghsa-g2pg-97r2-r2p9'

1 threat

Threats tagged 'ghsa-g2pg-97r2-r2p9'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.3	EPSS 0.5%	CVE-2026-94496jshERP · Missing Authorization High8.3EPSS 0.5%2026-09-21CVE Database V5CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant. EPSS 0.5%Vulnerability jishenghua #cwe-862 #ghsa-g2pg-97r2-r2p9	CVE Database V5	2026-09-21

Showing 1–1 of 1 result