Which versions of XXL-Job are affected by CVE-2026-65316?

XXL-Job 2.4.2 contains an authorization bypass flaw in the logDetailCat endpoint that allows any authenticated user to access execution logs from all job groups, regardless of role-based permissions.

How to fix or mitigate CVE-2026-65316?

Within 24 hours, inventory all XXL-Job 2.4.2 deployments, assess the sensitivity of data in execution logs, and audit access logs for suspicious logDetailCat queries. Within 7 days, restrict network access to the XXL-Job scheduler to a minimal trusted group via firewall or VPN, implement detailed API-level audit logging and alerting on logDetailCat calls, and review job configurations to minimize sensitive data logged. Within 30 days, subscribe to XXL-Job security advisories for patch availability and plan immediate deployment upon release, or evaluate and transition to an alternative job scheduler with verified authorization controls.

XXL-Job CVE-2026-65316

Q: What is the CVSS score of CVE-2026-65316?

CVE-2026-65316 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46439 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 VulnCheck

GHSA-7359-rm9q-rghc

Authentication Bypass Xxl Job Xuxueli

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, low complexity, requires any authenticated account so PR:L; discloses log content (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:05 vuln.today

CVE Published

Jul 21, 2026 - 21:23 cve.org

HIGH 7.1

DescriptionCVE.org

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

AnalysisAI

Cross-job-group log disclosure in XXL-Job 2.4.2 lets an authenticated low-privilege user read execution log content belonging to job groups they have no rights to, by calling the logDetailCat endpoint with incremented sequential logId values. The flaw is an insecure direct object reference (IDOR): logDetailCat omits the authorization check that its sibling logDetailPage endpoint enforces, so any logged-in account can enumerate and harvest sensitive log output across the entire scheduler. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

XXL-Job (xuxueli/xxl-job) is a widely used distributed task-scheduling framework for Java/Spring environments, where an admin console dispatches jobs to executor nodes and stores per-execution logs organized under job groups that gate visibility by role. The vulnerability is a CWE-639 Authorization Bypass Through User-Controlled Key: the logId parameter is a direct, sequentially assigned reference to a log record, and the logDetailCat handler that streams raw log content trusts that identifier without verifying the caller's permission to the owning job group. Because logDetailPage performs the group-level permission check but logDetailCat does not, the two endpoints are inconsistent, and the predictable integer key makes exhaustive enumeration trivial.

RemediationAI

No vendor-released patch version is identified in the available data, so no fixed release can be cited; monitor upstream issue https://github.com/xuxueli/xxl-job/issues/3983 and the VulnCheck advisory (https://www.vulncheck.com/advisories/xxl-job-cross-job-group-log-disclosure-via-missing-authorization-check-in-joblog-logdetailcat) for a tagged fix and upgrade as soon as one ships. As a compensating control, add the same job-group permission check that logDetailPage enforces to the logDetailCat handler (for self-built deployments, patch the JobLogController to validate the caller's group access before returning content), or place the admin console behind a reverse proxy that restricts the /joblog/logDetailCat path to trusted operators - noting this blocks legitimate cross-group operators too. Additionally, tighten account provisioning so only trusted staff hold console credentials (since exploitation requires an authenticated account) and audit what secrets jobs write to their logs, since minimizing sensitive data in log output reduces the impact of any disclosure.