CVE-2026-109178: jshERP Auth Bypass Vulnerability

CVE-2026-109178 Overview

CVE-2026-109178 is a missing authorization vulnerability [CWE-862] in jshERP through version 3.6. The flaw resides in LogController, which exposes audit log management endpoints without enforcing privilege checks. Any authenticated user, including low-privilege accounts, can invoke /log/add, /log/update, /log/delete, and /log/deleteBatch to tamper with audit records. Attackers can fabricate entries, overwrite user and IP fields, or erase evidence to conceal activity. The vulnerability directly undermines the integrity of forensic trails that incident responders rely on to reconstruct attacker behavior.

Critical Impact

Authenticated low-privilege users can forge, modify, or delete audit log entries, destroying forensic evidence and enabling attackers to hide malicious actions inside jshERP deployments.

Affected Products

• jshERP through version 3.6
• jshERP-boot backend component
• LogController audit log management interface

Discovery Timeline

• 2026-10-12 - CVE-2026-109178 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109178

Vulnerability Analysis

The vulnerability affects jshERP, an open-source enterprise resource planning platform. The LogController class exposes four audit log endpoints (/log/add, /log/update, /log/delete, /log/deleteBatch) that are reachable by any authenticated session. The controller delegates directly to LogService without validating whether the caller holds administrative or auditor privileges. Because audit logs capture user identifiers, source IP addresses, timestamps, and action descriptions, an attacker with any valid account can rewrite these fields. The result is a corrupted audit trail that cannot be trusted during investigations or compliance reviews.

Root Cause

The root cause is the absence of role-based authorization checks on write operations within LogController. The methods trust the authenticated session without verifying the user's permission scope for log management. This maps to [CWE-862] Missing Authorization, where functionality intended for privileged administrators is exposed to the broader authenticated user base.

Attack Vector

Exploitation requires network access to the jshERP web interface and a valid low-privilege user account. The attacker authenticates, obtains a session token, and issues HTTP requests to the vulnerable endpoints. A POST /log/add can inject fabricated events implicating other users. A POST /log/update can rewrite the user ID and IP columns of existing records. A POST /log/delete or /log/deleteBatch can erase evidence of unauthorized access. The exploitation flow is documented in the public GitHub PoC Script and vulnerable code is visible in the GitHub LogController Source Code.

Detection Methods for CVE-2026-109178

Indicators of Compromise

• HTTP requests to /log/add, /log/update, /log/delete, or /log/deleteBatch originating from non-administrative user sessions.
• Audit log entries with mismatched user identifiers and source IP addresses that do not correlate with authentication logs.
• Sudden gaps or deletions in audit log sequences, especially around periods of suspicious activity.
• Duplicate or anomalously backdated log entries that do not align with application access patterns.

Detection Strategies

• Correlate web server access logs against database-level audit log mutations to detect writes initiated by non-admin accounts.
• Monitor the jshERP jsh_log table for UPDATE and DELETE statements that modify historical records rather than appending new ones.
• Baseline normal /log/* endpoint usage and alert on any invocation of add, update, delete, or deleteBatch from standard user roles.

Monitoring Recommendations

• Forward jshERP application and web server logs to a centralized SIEM for cross-source correlation and tamper-evident retention.
• Enable database transaction auditing to capture the SQL user, timestamp, and query for every write against the audit log table.
• Alert on bulk delete operations against audit tables and require secondary review before such actions are considered legitimate.

How to Mitigate CVE-2026-109178

Immediate Actions Required

• Restrict network access to the jshERP interface to trusted administrative users until a patched build is available.
• Review all jsh_log records for integrity, comparing against external logs where possible, and preserve forensic snapshots.
• Audit all active jshERP accounts, revoke unused credentials, and rotate passwords for low-privilege users with unexpected activity.
• Deploy a reverse proxy rule that blocks requests to /log/add, /log/update, /log/delete, and /log/deleteBatch from non-admin sessions.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for jshERP through 3.6. Administrators should monitor the jshERP project repository and the VulnCheck Security Advisory for upstream fixes that add role-based authorization to LogController.

Workarounds

• Add a web application firewall rule that denies /log/add, /log/update, /log/delete, and /log/deleteBatch unless the session belongs to an administrator role.
• Patch LogController locally by inserting a role check that rejects requests from non-admin principals before invoking LogService methods.
• Move audit log storage to an append-only sink, such as a write-once database or external logging pipeline, so that application-level deletions cannot overwrite history.

# Example nginx rule to block audit log write endpoints at the edge
location ~ ^/log/(add|update|delete|deleteBatch)$ {
    # Only allow internal admin network ranges
    allow 10.0.0.0/24;
    deny all;
}