XXL-Job CVE-2026-65316

Exploitation requires an authenticated XXL-Job account (CVSS PR:L) with network access to the admin console's /joblog/logDetailCat endpoint; the attacker does not need admin rights or membership in the target job group. The specific enabling condition is that logDetailCat accepts a user-controlled, sequentially numbered logId and returns log content without the job-group permission check that logDetailPage applies, so any valid session can enumerate IDs. Limiting factors: an attacker must first obtain valid console credentials, impact is confined to reading log content (no write, code execution, or availability effect per VI:N/VA:N), and the value of what is exposed depends on how much sensitive data the deployment's jobs emit to their logs; only version 2.4.2 is confirmed affected.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and aligns well with the description: network-reachable, low attack complexity, requires a valid low-privilege account, no user interaction, and a high confidentiality impact with no effect on integrity or availability. No EPSS score, SSVC decision, or POC indicator was provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation - this is a confidentiality-only information-disclosure issue rather than an RCE or takeover. Real-world priority is moderate: exploitation is genuinely easy for anyone with any authenticated console access and the sequential IDs make bulk scraping simple, but the PR:L requirement and the fact that impact is limited to log-content disclosure keep it below critical. The main uncertainty is EPSS/POC status being unknown; treat the confidentiality impact as real but scope it to whatever secrets your job logs actually contain.

An attacker with a low-privilege XXL-Job console account, or an insider limited to one job group, scripts requests to /joblog/logDetailCat while incrementing the logId parameter from 1 upward. Each response returns the raw execution log for that record regardless of group ownership, letting the attacker scrape logs from restricted groups that may contain credentials, tokens, internal hostnames, or query output. The attack is straightforward given AV:N/AC:L and requires only PR:L, though no public POC is confirmed in the available data.