CVE-2026-109178: jshERP through 3.6 Missing Authorization via /log Audit Endpoints
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the affected endpoints?
Any authenticated jshERP user, including a low-privilege user, can exploit the missing authorization on the affected log endpoints. No administrative role is required according to the available information.
What does an attacker need to do to exploit this issue?
The attacker needs valid authentication to jshERP and network access to invoke the affected endpoints: /log/add, /log/update, /log/delete, or /log/deleteBatch. User interaction is not required.
How can an organization determine whether its audit trail may have been tampered with?
Review audit-log records for fabricated entries, altered user or IP fields, and unexpected deletions. Because the flaw permits deletion and modification of the records themselves, corroborate suspicious activity with independent sources such as application, web-server, or network logs where available.