PowerJob CVE-2025-11581

Exploitation requires network access to the PowerJob server's OpenAPI interface, specifically the /openApi/runJob endpoint exposed by OpenAPIController; the authorization check on this endpoint is missing, so no credentials are required (PR:N) and no user interaction is needed (UI:N). The practical LIMITING factor is exposure: PowerJob's OpenAPI/server port must be reachable by the attacker - instances bound to internal networks or placed behind authenticated gateways/firewalls are not reachable from the internet. Affected versions are PowerJob up to and including 5.1.2; deployments must be running a vulnerable build for the condition to apply.

This is a moderate-severity missing-authorization flaw (CWE-862) rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, but scopes impact very narrowly: only VC:L (low confidentiality), with VI:N and VA:N - no integrity or availability impact and a base score of just 5.5 (Medium). The E:P flag confirms proof-of-concept exploit code, consistent with the public issue report (PowerJob GitHub #1128). Signals are largely consistent: EPSS is low at 0.46% (38th percentile), there is NO CISA KEV listing, and the single CNA is VulDB. Net read: a publicly disclosed, easy-to-reach authorization gap, but with limited rated impact and no evidence of widespread or active exploitation. CONFLICT TO VERIFY: the affected endpoint is /openApi/runJob - triggering job execution typically implies an INTEGRITY (and potentially availability/RCE) impact, yet the official vector rates only VC:L with VI:N/VA:N. This under-weighting of integrity should be confirmed with the maintainer, because an attacker able to run arbitrary scheduled jobs could plausibly achieve more than low-confidentiality disclosure. Prioritize patching for internet-exposed PowerJob servers, but this is not a drop-everything KEV-grade item.

An attacker who can reach a PowerJob server's HTTP interface sends a crafted request directly to the /openApi/runJob endpoint, which fails to enforce authorization, and triggers job execution without valid credentials. Because the issue has been publicly disclosed with proof-of-concept detail (VulDB / GitHub issue #1128), an opportunistic attacker scanning for exposed PowerJob instances could invoke this endpoint remotely without authentication (PR:N).