CVE-2026-109179 in jshERP
Summary
by MITRE • 10/12/2026
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The jshERP software version 3.6 and earlier contains a critical missing authorization vulnerability within its LogController component, which fundamentally compromises the integrity of audit logging mechanisms designed for multi-tenant environments. This flaw stems from an insufficient access control check that fails to verify whether the authenticated user initiating a request has administrative privileges or ownership rights over the specific tenant data being accessed. Consequently, any validly authenticated account, regardless of its assigned role or privilege level within the application hierarchy, can bypass intended security boundaries and retrieve sensitive operational audit logs belonging to other users or tenants. This represents a classic instance of insecure direct object references combined with broken access control, where the system trusts client-supplied identifiers without validating the requester's entitlements against those resources.
From a technical perspective, the vulnerability is exploited by sending HTTP GET requests to specific endpoints such as /log/list and /log/info. These endpoints are intended for administrative oversight or self-auditing but lack server-side validation of user roles relative to the requested log entries. When an attacker with low-privilege credentials interacts with these API routes, the backend logic retrieves and returns comprehensive details about system activities without filtering based on tenant isolation policies. The data exposed includes login usernames, source client IP addresses, timestamps, and specific actions performed by other users within the same instance or potentially across tenants if multi-tenancy is not strictly enforced at the database query level. This exposure allows attackers to map out user identities and network infrastructure details that should remain confidential under standard security models for enterprise resource planning systems.
The operational impact of this vulnerability extends beyond simple data leakage, as it facilitates deeper reconnaissance attacks against the target organization. By analyzing the exposed audit logs, an attacker can identify high-value targets such as administrators or privileged accounts based on their login patterns and IP addresses. This information is instrumental in crafting targeted phishing campaigns or privilege escalation attempts aimed at those specific individuals. Furthermore, knowledge of client IP addresses aids attackers in understanding network topology and firewall rules, potentially aiding in lateral movement within the internal network if other vulnerabilities are present. The exposure also violates core principles of confidentiality required by compliance frameworks such as GDPR, HIPAA, and PCI DSS, which mandate strict access controls over sensitive operational data to prevent unauthorized disclosure.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site or similar misconfigurations depending on implementation details, but primarily falls under the category of broken object level authorization where users can act as other users by manipulating input parameters that are not properly validated. In terms of threat modeling, this behavior corresponds directly to MITRE ATT&CK technique T1078 Valid Accounts and specifically supports reconnaissance activities categorized under T1592 Gather Victim Host Information or T1071 Application Layer Protocol for data exfiltration via standard web traffic. The ability to enumerate user identities and network locations significantly lowers the barrier of entry for subsequent attack phases, transforming a simple authentication bypass into a strategic intelligence gathering tool for adversaries.
To mitigate this vulnerability, developers must implement robust role-based access control checks within the LogController methods before processing any requests related to audit logs. It is essential that server-side logic verifies not only that the user is authenticated but also that they possess explicit administrative privileges or are accessing their own tenant's data exclusively. Input validation should ensure that resource identifiers correspond strictly to objects owned by the requesting entity, enforcing strict multi-tenancy isolation at both the application and database layers. Additionally, implementing principle of least privilege ensures that low-privilege users do not have access to endpoints designed for system-wide monitoring unless explicitly authorized through a secure administrative interface with additional authentication factors such as two-factor authentication. Regular security audits and penetration testing focusing on authorization bypasses are recommended to identify similar flaws in other controllers within the application architecture.