CVE-2026-109179: jshERP through 3.6 Missing Authorization via /log/list and /log/info
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated jshERP user, including a low-privilege user, can exploit it. The attacker needs only to send GET requests to the affected log endpoints.
What information could be exposed?
An attacker can read the tenant's operation audit log, including other users' login names, client IP addresses, and recorded actions.
Which endpoints should be reviewed for exposure?
Review access to GET /log/list and GET /log/info. These endpoints are identified as allowing authenticated users to view audit-log data without the required authorization checks.
How can an organization determine whether it is affected?
An installation of jshERP through version 3.6 is affected if a low-privilege authenticated account can retrieve other users' audit-log entries through /log/list or /log/info.