CVE-2026-109179
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Authenticated low-privilege users can view tenant audit logs containing other users' login names, IP addresses, and actions. They only need standard network access and a valid account.
Root cause
LogController endpoints lack role-based authorization checks, permitting any logged-in user to query the audit logs.
Affected systems
jshERP through 3.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade to a fixed release if available; otherwise, block or restrict access to the /log/list and /log/info endpoints at your reverse proxy or API gateway for non-admin sessions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.
References
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_audit_log_and_message_tampering.py
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/LogController.java#L40-L68
- https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/service/LogService.java#L41-L80
- https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-via-log-list-and-log-info