What is the CVSS score of CVE-2026-90487?

CVE-2026-90487 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-90487?

Yes, a public proof-of-concept exploit is available for CVE-2026-90487. Prioritise patching immediately. EPSS: 0.2%.

xxl-job CVE-2026-90487

EUVD-2026-76921 LOW

Improper Privilege Management (CWE-269)

2026-09-12 VulDB

GHSA-w26j-6rp4-vhj5

Privilege Escalation Java Xxl Job Xuxueli

2.1

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege xxl-job admin credentials
Delivery

Authenticate to admin web interface
Exploit

Send direct HTTP request to loadById endpoint
Execution

Enumerate executor group IDs sequentially
Impact

Extract executor addresses and configuration data

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated session in the xxl-job admin web interface - the CVSS PR:L metric indicates at least low-privilege credentials are needed, though the POC title ('Missing Authentication') suggests the endpoint may not verify role or ownership. The xxl-job-admin web service must be network-accessible to the attacker. Limiting factors: exploitation is bounded to reading executor group metadata (group name, addresses, registration mode); no write, delete, or code execution capability is indicated. The vendor has not confirmed whether any default login or guest-level access is sufficient, creating ambiguity about the true authentication barrier.
Impact	The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) correctly categorizes this as low-severity - the impact is limited to confidentiality of executor group configuration data with no integrity or availability consequences. The E:P supplemental metric confirms a publicly available proof-of-concept, but real-world exploitation risk remains modest given the authentication prerequisite (PR:L) and low data sensitivity. A key discrepancy exists: the POC document title asserts 'Missing Authentication' while the CVSS vector assigns PR:L, implying some session-level access is still required - this should be verified against the actual POC. The 'Privilege Escalation' tag in the input metadata overstates the impact relative to the CVSS metrics, which show read-only access to low-value configuration data. No KEV listing, no EPSS score provided, and vendor non-response increases uncertainty about patch timeline.
Exploit ScenarioDerived	An attacker with a valid low-privilege xxl-job admin account sends a direct HTTP GET or POST request to the `/jobgroup/loadById?id=<N>` endpoint, iterating over numeric IDs to enumerate all executor group configurations including their registered addresses and titles. A public proof-of-concept demonstrating this enumeration is available on GitHub.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 12, 2026

Improper privilege management in xxl-job admin up to version 3.4.2 exposes the loadById endpoint of JobGroupController.java to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the disclosure. As a compensating control, restrict access to the xxl-job admin interface at the network perimeter so only authorized administrative IP ranges can reach it, reducing exposure to the loadById endpoint. Additionally, implement application-level WAF rules or a reverse proxy with authentication enforcement in front of the admin panel to limit who can issue requests to /jobgroup/loadById. Review and harden xxl-job admin role assignments to ensure that only administrators are granted any login credentials. Monitor VulDB (https://vuldb.com/vuln/403075) and the official xxl-job repository for an upstream patch. Trade-off: network-level restriction does not fix the underlying authorization flaw and does not protect against insider or post-authentication abuse.

Affected VersionsENISA

xxl-job 3.4.1

xxl-job 3.4.0

xxl-job 3.4.2

Affected Packages

euvd xxl_job no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

xxl-job is a distributed task scheduling framework for Java/Spring applications, maintained by Xuxueli (cpe:2.3:a:xuxueli:xxl-job). The affected component is JobGroupController.java within the xxl-job-admin module, which manages executor groups - logical groupings of job executors including their addresses and registration modes. CWE-269 (Improper Privilege Management) indicates that the loadById endpoint does not enforce proper role-based access controls, allowing a low-privilege authenticated user to retrieve executor group records by ID. The POC is titled 'loadById Endpoint Missing Authentication,' suggesting the endpoint may perform no meaningful authorization check beyond session presence, consistent with broken object-level authorization (BOLA/IDOR) patterns.

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

vuln.today AI 4.3 MEDIUM

Network-accessible endpoint requires low-privilege session; impact is read-only access to executor group config with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Sep 12, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Sep 12, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Sep 12, 2026 - 23:00 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Medium

popular Java distributed scheduler, widely used in Chinese enterprises

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.