Privilege escalation via unchecked account creation

Improper authorization in jshERP 3.0 through 3.5 allows remote authenticated users to create arbitrary privileged accounts. The /jshERP-boot/user/addUser endpoint accepts attacker-chosen account and role data after login without validating an administrator role or fine-grained permission. Any low-privilege account can invoke the endpoint to add administrator-level users or assign permissions from other groups, enabling full application compromise.