CVE-2026-109179 — jshERP through 3.6 Missing Authorization via /log/list and /log/info
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege use…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7