CVE-2026-65316 PUBLISHED

xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

Assigner: VulnCheck
Reserved: 21.07.2026 Published: 21.07.2026 Updated: 21.07.2026

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor xuxueli
Product xxl-job
Versions Default: affected
  • affected from 0 to 2.4.2 (incl.)

Credits

  • George Chen reporter

References

Problem Types

  • Authorization Bypass Through User-Controlled Key CWE