Summary
jshERP 3.6 contains an authorization flaw in the updateOneValueByKeyIdAndType endpoint that allows an authenticated tenant user to assign arbitrary roles to their own account. A low-privilege user could potentially become a tenant administrator by submitting a UserRole update containing their user ID and a chosen role list.
Affected context
The vulnerability occurs in deployments where authenticated tenant users can reach the updateOneValueByKeyIdAndType endpoint and the endpoint accepts UserRole updates without adequately enforcing role-management permissions. Risk is greater when role assignments are controlled only by request parameters rather than by server-side authorization tied to the caller's effective privileges.
Exploit preconditions
- Attack surface: The authenticated HTTP API endpoint
updateOneValueByKeyIdAndType
- Required access: A valid low-privilege tenant user account - Trigger point: A POST request that submits a UserRole update for the
caller's user ID and specifies one or more role IDs
- Why exploitation is possible: The endpoint may authorize the general
request without confirming that the caller is permitted to assign the
requested roles
Why this happens
The underlying bug is an authorization decision that does not sufficiently constrain a sensitive role-assignment operation. The endpoint appears to trust user-controlled identifiers and role values without enforcing server-side checks for administrative authority, tenant scope, and permitted target roles. This behavior maps to CWE-862, Improper Authorization, because an authenticated principal can perform an action outside the privileges granted to that principal.
Potential impact
- An authenticated user may gain tenant-administrator privileges.
- An attacker could access or modify tenant-managed data.
- Account, permission, or application settings could be changed.
- The compromised account could facilitate further unauthorized actions within the tenant.
General mitigation guidance
Mitigation generally centers on enforcing authorization at the operation boundary rather than relying on client-supplied role or user identifiers. Common defensive patterns include requiring a dedicated, server-side permission for role administration; verifying that the caller may manage the target account and each requested role; deriving the target identity from trusted session context where appropriate; applying tenant-boundary checks; and using deny-by-default handling for sensitive update types. Role assignment should be performed through narrowly scoped service operations, with least-privilege administrative accounts and audit logging for changes.
How teams detect issues like this
Detection approaches include static and manual review of endpoints that update roles, permissions, or account attributes; searches for authorization checks that occur only at route level; and inspection of code paths that trust request-supplied user IDs, role IDs, or update types. API tests can verify that ordinary tenant users cannot assign administrative roles or modify authorization data outside their scope. Runtime monitoring can alert on unusual role changes, self-assignment of elevated roles, and privilege transitions initiated by non-administrative accounts. Automated code review and policy tools may help identify missing authorization guards.
