Description

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:30.813Z",
  "pubdate": "2026-10-12T13:17:30.813Z",
  "executiveSummary": "jshERP versions up to and including 3.6 are affected by an improper authorization vulnerability located within the LogController component.\nThe vulnerability allows authenticated users with low-privilege access to bypass standard security controls and gain unauthorized read access to the application's audit trail.\nBy manipulating requests, attackers can retrieve sensitive data, including login identifiers, client source IP addresses, and detailed records of system actions performed by other users.\nThis flaw represents a significant risk to organizational privacy and security auditing integrity, as it enables unauthorized reconnaissance of system activity.\nExploitation requires the attacker to possess a valid, albeit low-privileged, user account within the system.\nThe impact includes the exposure of user metadata and operational patterns, which may be leveraged to facilitate further unauthorized activities or social engineering.",
  "technicalDetails": "The vulnerability originates in the LogController component of the jshERP application. The root cause is a failure to implement mandatory server-side authorization checks during the processing of requests to specific audit log endpoints.\nSpecifically, the application fails to validate the current user's session permissions against the requested resource scope before executing the handler logic for log retrieval.\nThe affected endpoints include /log/list and /log/info, which are designed to expose structured data regarding system operations. In a properly secured environment, these functions should be restricted to administrative roles; however, the lack of an access control check allows any authenticated user to invoke these methods.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates into the application using a standard, low-privileged user account. 2) The attacker initiates an HTTP GET request to the targeted API endpoints, such as /log/list. 3) The application's LogController processes the request without validating whether the requester possesses the 'admin' or equivalent authorization level. 4) The backend executes the database query to retrieve audit records. 5) The server serializes the full result set, which contains potentially sensitive data from across the tenant, and returns it in the HTTP response body.\nThe exposed data includes user login names, client-side IP addresses, and internal operation logs, providing a roadmap of user activity that could be used to map out administrative behaviors or identify potential targets for privilege escalation.\nThe vulnerability is accessible to any user with active session credentials, requiring no advanced network position or complex exploit chains. The stateless nature of the HTTP requests makes these calls easy to automate, allowing an attacker to scrape and exfiltrate the entire audit history of the application instance efficiently.\nThis exposure violates the principle of least privilege, as the information disclosed constitutes sensitive operational metadata that should remain protected from unauthorized viewing."
}