The reported flaw is a missing authorization check in the LogController of jshERP through version 3.6. Any authenticated user can query the /log/list or /log/info endpoints, which return the tenant's operation audit trail, including other users' login names, client IP addresses, and actions. Because the check is absent, the application exposes sensitive operational data to low‑privilege accounts, effectively leaking confidential information about account usage. The weakness is a classic Missing Authorization condition (CWE-862).

Affected systems are jshERP EA from jishenghua. The vulnerability is present in all releases up to and including version 3.6. Users running 3.0–3.6 without a patch are susceptible. No further product variants are listed.

The CVSS base score is 5.3, indicating a medium impact. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. An attacker only needs an existing user account to exploit the flaw, meaning that any compromised or low‑privilege credential can be used. Because the endpoints respond over HTTP and require no special privileges beyond authentication, exploitation is straightforward. The risk lies primarily in accidental data exposure rather than active denial of service or code execution.