EUVD-2026-26148Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-panel endpoint likely requires at least a low-privilege session; only execution log confidentiality is impacted; high complexity due to logId enumeration requirement.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.
AnalysisAI
Improper resource identifier control in Xuxueli xxl-job versions 3.3.0 through 3.3.2 exposes execution log entries to unauthorized disclosure via logId parameter manipulation in the admin Execution Log Handler. The commit diff reveals that JobGroupPermissionUtil.validJobGroupPermission was commented out in JobLogController.java, effectively removing the job-group-level access boundary and enabling IDOR-style cross-boundary log reads. A public proof-of-concept exploit exists per SSVC (Exploitation: poc), though a CVSS 4.0 score of 2.9 and EPSS of 0.05% (16th percentile) reflect that high attack complexity and limited confidentiality impact constrain real-world risk; no active exploitation is confirmed in CISA KEV.
Technical ContextAI
xxl-job is a distributed Java-based job scheduling framework maintained by Xuxueli, widely used in Chinese enterprise environments. The vulnerable component is JobLogController.java within the xxl-job-admin web module, specifically the logDetailCat function that streams execution log content by logId. CWE-99 (Improper Control of Resource Identifiers) is the root cause: the controller accepted caller-supplied logId values without validating that the requesting party had permission to access the corresponding job group's logs. The commit diff at d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a confirms the fix: explicit whitelist validation of jobGroup and jobId against jobGroupIds and jobIds lists derived from permitted groups, replacing the previously commented-out JobGroupPermissionUtil.validJobGroupPermission call. The XxlJobLogMapper.xml was also patched to fix a query condition (jobId==0 and jobGroup gt 0 → jobGroup gt 0) that could have permitted unbounded group-level log queries. Affected versions per EUVD are xxl-job 3.3.0, 3.3.1, and 3.3.2.
RemediationAI
Upgrade xxl-job-admin to version 3.4.0, the vendor-released patched version documented at https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0 and corresponding to commit d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. The patch is confirmed available from the vendor per the advisory. If immediate upgrade is not possible, a compensating control is to restrict network access to the xxl-job admin interface to trusted internal networks or VPN endpoints only, preventing unauthenticated or low-privileged external actors from reaching the logDetailCat endpoint; note this does not address insider threat or post-compromise lateral movement scenarios. Additionally, the database index script referenced in the patch documentation (create index I_jobgroup on xxl_job_log (job_group)) should be applied alongside the upgrade to support the new group-scoped log query path.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today