Description

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T13:17:30.643Z",
  "pubdate": "2026-10-12T13:17:30.643Z",
  "executiveSummary": "jshERP versions up to and including 3.6 are affected by a critical missing authorization vulnerability within the LogController component.\nThis vulnerability stems from the application's failure to enforce adequate access control checks for administrative log management functions.\nThe flaw allows any authenticated user, regardless of their privilege level, to interact with sensitive audit log endpoints.\nAn attacker can exploit this to forge, modify, or delete audit log entries, effectively compromising the integrity of the system's security trails.\nThe primary risk implications include the potential for attackers to rewrite user identifiers and source IP addresses, as well as the complete erasure of logs to obfuscate malicious activity.\nThe vulnerability is limited to authenticated users; however, the lack of role-based access control (RBAC) verification on these specific controller methods renders low-privileged accounts highly dangerous in a security-conscious environment.\nExploitation requires active authenticated access to the application, after which the attacker can interact directly with the vulnerable API endpoints to manipulate the underlying database records associated with system auditing.",
  "technicalDetails": "The vulnerability resides in the LogController component of jshERP, specifically affecting the handling of HTTP requests mapped to audit log management functionalities.\nThe application fails to perform authorization checks to verify if the requesting user possesses administrative privileges before executing sensitive operations.\nThe vulnerable functions include /log/add, /log/update, /log/delete, and /log/deleteBatch. Because the controller does not implement adequate server-side authentication and authorization middleware for these routes, any authenticated user can trigger these actions by sending standard HTTP requests to these endpoints.\nAttack flow: Upon authenticating with the application, an attacker identifies the relevant API endpoints through standard traffic analysis. By constructing HTTP POST or DELETE requests targeting the aforementioned paths, the attacker bypasses intended security boundaries. For instance, invoking /log/update with crafted JSON payloads allows an attacker to overwrite existing records.\nBy manipulating the parameters sent to these endpoints, an attacker can fabricate log entries to inject false attribution, essentially framing other users or masking the source of an attack by spoofing IP addresses stored in the log table.\nFurthermore, the use of /log/delete and /log/deleteBatch provides the attacker with the capability to perform selective log deletion. This is a critical security concern as it facilitates the removal of evidence following unauthorized system access or lateral movement, effectively neutralizing incident response and forensic capabilities.\nThe root cause is an insecure implementation of access control logic within the controller layer, where administrative operations are exposed to lower-privileged application roles. There is no verification of user permissions mapped against the requested log modification action, allowing vertical privilege escalation in the context of log management.\nThe lack of robust input validation or transaction-level auditing for these management functions exacerbates the impact, as the system does not differentiate between legitimate administrative logs and attacker-controlled modifications.\nThe vulnerability is present in versions up to 3.6. It is highly exploitable provided the attacker has valid user credentials within the jshERP environment, as no further privileges are required to reach the vulnerable code paths in LogController."
}