CVE-2026-109179: jshERP Information Disclosure Vulnerability

CVE-2026-109179 Overview

CVE-2026-109179 is a missing authorization vulnerability in jshERP through version 3.6. The flaw resides in the LogController component, which fails to enforce role-based access controls on operation audit log endpoints. Any authenticated low-privilege user can send GET requests to /log/list or /log/info and retrieve the tenant's full audit trail. The exposed data includes login names, client IP addresses, and user actions across the tenant. The vulnerability is tracked under CWE-862: Missing Authorization and is documented in the VulnCheck Advisory on jshERP.

Critical Impact
Authenticated low-privilege users can enumerate administrator login names, source IP addresses, and operational activity across the entire tenant, enabling reconnaissance for follow-on attacks.

Affected Products

jshERP through version 3.6
jshERP-boot backend component containing LogController.java
Deployments exposing the /log/list and /log/info endpoints to authenticated users

Discovery Timeline

2026-10-12 - CVE-2026-109179 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109179

Vulnerability Analysis

The vulnerability stems from an absent authorization check in the LogController class of the jshERP-boot backend. The controller exposes two endpoints, /log/list and /log/info, that return rows from the tenant's operation audit log. These endpoints require only a valid authenticated session and do not validate whether the caller holds an administrative role.

Any account that can log into the application can therefore retrieve audit records belonging to other users within the same tenant. The returned records include login names, client IP addresses, timestamps, and the operations performed. This information supports account enumeration, targeted phishing against identified administrators, and reconnaissance of privileged workflows. The implementation can be reviewed in the referenced GitHub Log Controller Code and GitHub Log Service Code.

Root Cause

The root cause is a missing authorization enforcement layer on sensitive controller methods. The LogController methods rely on authentication alone, with no role check, tenant filter, or ownership check applied to the queried audit rows. The underlying LogService returns records without constraining results to the caller's identity or privilege level.

Attack Vector

An attacker first obtains or creates any low-privilege account in the target jshERP instance. The attacker then issues an authenticated GET request to /log/list with pagination parameters, or to /log/info with a specific log identifier. The server returns audit entries for all users, which the attacker parses to extract login names, source IP addresses, and administrative actions. A proof-of-concept demonstrating the request flow is available in the GitHub PoC Repository.

The vulnerability is described in prose only; refer to the external references above for request structure and endpoint parameters.

Detection Methods for CVE-2026-109179

Indicators of Compromise

Repeated authenticated GET requests to /log/list or /log/info originating from non-administrative accounts.
Unusual pagination enumeration patterns against the /log/list endpoint from a single session.
Access to audit log endpoints from user accounts that have no legitimate operational need to review audit history.

Detection Strategies

Correlate HTTP access logs with application role data to flag calls to /log/* endpoints made by non-admin principals.
Monitor for sequential log identifier enumeration against /log/info indicating automated scraping.
Alert on high-volume responses from /log/list returned to accounts outside the administrator group.

Monitoring Recommendations

Forward jshERP web server and application logs to a centralized analytics platform for role-aware query analysis.
Baseline normal access patterns to audit endpoints and alert on deviations in request volume or caller role.
Track outbound data volumes from /log/* endpoints per session to detect bulk exfiltration of audit records.

How to Mitigate CVE-2026-109179

Immediate Actions Required

Restrict network access to the jshERP management interface so that only trusted users can authenticate.
Review existing user accounts and remove or disable any unused low-privilege accounts that could be abused for log access.
Rotate credentials for administrative accounts whose login names may already have been exposed through the audit log.

Patch Information

At the time of publication, no fixed version of jshERP has been identified in the NVD entry. Operators should monitor the upstream jshERP repository and the VulnCheck Advisory on jshERP for a vendor fix. Until an official patch is available, apply the compensating controls below.

Workarounds

Add a reverse proxy or web application firewall rule that blocks requests to /log/list and /log/info from sessions not associated with administrative roles.
Introduce a server-side authorization filter in LogController that validates the caller's role before invoking the LogService query methods.
Limit audit log retention and the data fields returned to the client so that exposure is minimized if the endpoint is reached.

bash

# Example nginx rule restricting access to jshERP log endpoints by source network
location ~ ^/log/(list|info) {
    allow 10.0.0.0/24;    # administrator management subnet
    deny all;
    proxy_pass http://jsherp_backend;
}