Is CVE-2026-109178 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109178?

CVE-2026-109178 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-109178

Description

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.