jshERP CVE-2026-109178

Requires a valid authenticated jshERP session at any low-privilege level (PR:L) - the LogController endpoints /log/add, /log/update, /log/delete, and /log/deleteBatch lack per-action authorization checks, so no admin role or special configuration is needed. No user interaction and no non-default feature or deployment mode is required; the only limiting factor is that the attacker must first possess or obtain any authenticated account, so fully anonymous unauthenticated exploitation is not possible.

This is a medium-severity integrity/repudiation issue (CVSS 4.0 base 5.3), not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) is internally consistent with the description: network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and causing only limited integrity (VI:L) and availability (VA:L) impact to audit data, with no confidentiality impact (VC:N). Publicly available exploit code exists (GitHub POC), which raises real-world likelihood, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the signals point to a credible but low-urgency issue. The genuine risk here is anti-forensic: an authenticated insider or an attacker who has already obtained any low-privilege account can fabricate, rewrite, or erase audit logs to destroy evidence of other activity, undermining accountability rather than directly compromising data or systems. No data is strongly conflicting; the main caveat is that the 'Authentication Bypass' tag contradicts CWE-862 (Missing Authorization) - this is a post-authentication authorization flaw, not an authentication bypass.

An attacker with any valid low-privilege jshERP account (or one who has phished/reused such credentials) sends HTTP requests to the unprotected /log/delete and /log/deleteBatch endpoints to erase audit records that would reveal their fraudulent transactions, then calls /log/add and /log/update to insert forged entries attributing activity to another user or IP. A public Python POC (poc_audit_log_and_message_tampering.py) already demonstrates the log-tampering flow, lowering the skill needed to weaponize it.