CVE-2026-109178: Missing Authorization in jishenghua jshERP

CVE-2026-109178 is a missing authorization vulnerability in jshERP through version 3.6 affecting the LogController component. The vulnerability permits any authenticated user with low privileges to invoke the /log/add, /log/update, /log/delete, and /log/deleteBatch endpoints without proper authorization checks. This enables unauthorized manipulation of audit logs, including forging entries, modifying user and IP fields, and deleting records, which can undermine the integrity of audit trails.

The vulnerability compromises the integrity and reliability of audit logs by allowing unauthorized users to fabricate, modify, or delete log entries. This can hinder forensic investigations, enable concealment of malicious activities, and reduce trust in the system's audit mechanisms. However, exploitation requires authenticated access with at least low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and monitor for suspicious activity related to log manipulation. Implement additional access controls or compensating controls to prevent unauthorized use of log management functions.