EUVD-2026-40362
GHSA-cg8w-ggx5-v8p7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 30, 2026
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export the full contents of any report via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, JimuReportTokenInterceptor skips all authentication and the export service never checks the auto-export configuration flag, so any guessed report id is rendered and streamed back. Publicly available exploit code exists; the disclosure comes from VulnCheck and the CVSS 4.0 base score is 8.7 (High), driven by high confidentiality impact with no privileges or user interaction required.
Earlier versions of this analysis (2)
Unauthenticated report data exfiltration in JeecgBoot JimuReport through 2.5.0 lets remote attackers export any report's full rendered contents via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, JimuReportTokenInterceptor skips all authentication and authorization, and the export service never checks the auto-export configuration flag, so an attacker who enumerates Snowflake report IDs retrieves SQL query results and any credentials embedded in report data sources. Publicly available exploit code exists (reported by VulnCheck); no public active-exploitation listing identified.
Unauthenticated report data exfiltration in JeecgBoot JimuReport through 2.5.0 allows remote attackers to dump the full contents of any report via the POST /jmreport/auto/export endpoint. Because the handler carries the @JimuNoLoginRequired annotation, the JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams any report by id without checking the auto-export configuration flag - exposing report SQL query results and any credentials embedded in data sources. Publicly available exploit code exists (reported by VulnCheck), though it is not listed in CISA KEV; the CVSS 7.5 reflects confidentiality-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Jimureport gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is confidential data and credential disclosure only, so C:H, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.
Executive ViewAI
JimuReport versions through 2.5.0 contain an unauthenticated remote vulnerability enabling attackers to export the complete contents of any report without valid credentials or user interaction. Any network-accessible instance allows adversaries to systematically exfiltrate all stored reports, exposing sensitive business, financial, and operational data. Organizations using this platform face immediate risk of data theft, competitive intelligence compromise, and potential regulatory violations.
24 hours: Identify all systems running JimuReport through version 2.5.0; implement firewall or WAF rules to block POST requests to /jmreport/auto/export; review access logs for suspicious export activity. 7 days: Deploy WAF filtering rules for the vulnerable endpoint; establish comprehensive audit logging and monitoring for unauthorized report access attempts. 30 days: Escalate to vendor for patched version availability; if unavailable, initiate evaluation and planning for migration to alternative reporting platform with active security support.
Restrict network access to POST /jmreport/auto/export endpoint via firewall rules or Web Application Firewall (WAF) blocking. Implement request filtering and rate limiting on export endpoints. Enable comprehensive audit logging of all report access. Monitor for patterns indicating systematic report enumeration. No vendor-released patch identified at time of analysis; escalate vendor contact for security update timeline and interim security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Jimureport
View allJimuReport through 2.1.3 has RCE via user-controlled H2 JDBC URLs. The application passes attacker-supplied JDBC connect
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. Rated critical severity (CVSS 9.8), this vulnerability is
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Rated critical severity (CVSS 9.8)
Unauthenticated access to JimuReport's report folder template listing endpoint exposes all report definitions, share tok
A vulnerability was found in jeecgboot JimuReport up to 2.1.2. Rated medium severity (CVSS 5.3), this vulnerability is r
A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Rated medium severity (CVSS 5.3), this vulnerability
Code injection in JimuReport's Data Source Handler allows authenticated high-privilege users to execute arbitrary code v
A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Rated medium severity (CVSS 5.3), this vulnerability
Exploit-DB