CVE-2026-109179: Missing Authorization in jishenghua jshERP

CVE-2026-109179 describes a missing authorization vulnerability in jshERP through version 3.6 within the LogController component. The vulnerability permits any authenticated user to bypass authorization controls and read the tenant's operation audit logs. Low-privilege users can exploit this by issuing GET requests to specific endpoints (/log/list or /log/info) to retrieve sensitive audit data including login names, IP addresses, and user actions.

The vulnerability exposes sensitive tenant audit log information to unauthorized authenticated users. This can lead to information disclosure about user activities, login details, and client IP addresses, potentially aiding further reconnaissance or targeted attacks. However, it does not allow privilege escalation or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only or implement additional access controls at the network or application layer to prevent unauthorized access to audit logs.