Which versions of Jimureport are affected by CVE-2026-58375?

JimuReport versions through 2.5.0 contain an unauthenticated remote vulnerability enabling attackers to export the complete contents of any report without valid credentials or user interaction.

Is there a public PoC exploit available for CVE-2026-58375?

Yes, a public proof-of-concept exploit is available for CVE-2026-58375. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-58375?

24 hours: Identify all systems running JimuReport through version 2.5.0; implement firewall or WAF rules to block POST requests to /jmreport/auto/export; review access logs for suspicious export activity. 7 days: Deploy WAF filtering rules for the vulnerable endpoint; establish comprehensive audit logging and monitoring for unauthorized report access attempts. 30 days: Escalate to vendor for patched version availability; if unavailable, initiate evaluation and planning for migration to alternative reporting platform with active security support.

Jimureport CVE-2026-58375

Q: What is the CVSS score of CVE-2026-58375?

CVE-2026-58375 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40362 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-30 VulnCheck

GHSA-cg8w-ggx5-v8p7

Authentication Bypass Jimureport Jeecgboot

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is confidential data and credential disclosure only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 17:34 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:19 vuln.today

DescriptionCVE.org

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.

AnalysisAI

Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export the full contents of any report via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, JimuReportTokenInterceptor skips all authentication and the export service never checks the auto-export configuration flag, so any guessed report id is rendered and streamed back. Publicly available exploit code exists; the disclosure comes from VulnCheck and the CVSS 4.0 base score is 8.7 (High), driven by high confidentiality impact with no privileges or user interaction required.