CVE-2026-109178 — jshERP through 3.6 Missing Authorization via /log Audit Endpoints
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privileg…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7