jshERP CVE-2026-109179

Attacker must possess valid credentials for any low-privilege account on the target jshERP instance (PR:L). Given such an account, the LogController endpoints /log/list and /log/info perform no per-user/role authorization check (CWE-862), so any authenticated user can read the full tenant operation audit log. Exploitation is remote over HTTP with no user interaction and no non-default configuration required; the primary limiting factor is the need for a pre-existing authenticated account, which confines the threat to insiders or attackers who have already obtained low-privilege access. Impact is limited to disclosure of audit metadata (login names, client IPs, actions) - no write, integrity, or availability effect is described.

This is a low-to-moderate priority information-disclosure issue, not an urgent emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: a network-reachable, low-complexity read performed by an already-authenticated low-privilege user, with only limited confidentiality impact (VC:L) and no integrity or availability impact. The PR:L metric correctly reflects that this is an authorization flaw (CWE-862), not an unauthenticated authentication bypass - the attacker must first hold a valid account. Publicly available exploit code exists (GitHub POC), which raises practical exploitability, but there is no EPSS score provided and no CISA KEV listing, so there is no public exploit identified as actively exploited at time of analysis; the signals point to proof-of-concept availability rather than confirmed mass exploitation. One conflict to verify: the POC filename references 'message tampering' in addition to audit-log reading, which would imply integrity impact beyond the read-only disclosure described by NVD/VulnCheck - the input description and CVSS (VI:N) only support confidentiality disclosure, so any tampering claim should be verified with the vendor/VulnCheck advisory before being treated as fact.

An attacker who holds any low-privilege account on a jshERP (≤3.6) tenant sends a simple GET request to /log/list or /log/info and receives the tenant's operation audit log, exposing other users' login names, client IP addresses, and actions. A publicly available POC exists, so exploitation requires only valid credentials and a standard HTTP client, with no user interaction and low attack complexity.