The vulnerability is a missing authorization flaw in the LogController of jshERP, allowing any authenticated user to forge, modify, or delete audit log entries. This flaw lets low‑privilege users call /log/add, /log/update, /log/delete, and /log/deleteBatch to create fabricated entries, alter user and IP fields, or erase existing records, thereby compromising audit integrity and enabling concealment of malicious or misconfigured activity.

The issue affects jishenghua's jshERP product through version 3.6.

The CVSS score of 5.3 indicates moderate severity, and the EPSS data is unavailable. The flaw is not listed in the CISA KEV catalog. Because the missing authorization applies to any authenticated user, the likely attack vector is an internal user with valid credentials acting through the web application; no remote code execution is possible, but the impact manifests as loss of trust in audit records and potential regulatory non‑compliance.