EUVD-2026-102426Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated admin to malicious page
-
DeliveryBrowser auto-submits forged /user/insert request
-
ExploitXXL-JOB processes request under admin session
-
ExecutionAttacker-controlled admin account created
-
ImpactFull scheduler takeover
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a victim with an active, authenticated XXL-JOB administrator session in their browser who is lured into visiting an attacker-controlled page; the vulnerable endpoints (/user/insert, /user/update, /user/delete) have no CSRF token and do not restrict HTTP method, so no special product configuration is needed beyond the admin console being deployed and reachable. The key limiting factor is this mandatory user interaction (UI:R): the attack cannot succeed against a logged-out admin and depends entirely on browser session riding, which same-site cookie defaults or reverse-proxy protections could blunt. |
| Impact | This is a credible, well-defined CSRF flaw (CWE-352, consistent with the 'CSRF' tag) in XXL-JOB's JobUserController, where /user/insert, /user/update, and /user/delete lack anti-CSRF tokens and do not restrict HTTP method - meaning they can be triggered via simple GET/cross-origin requests. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) is internally consistent with CSRF: PR:N reflects that the attacker needs no account, while UI:R correctly captures the hard requirement that an already-authenticated administrator be tricked into triggering the request. No EPSS score, KEV listing, or confirmed POC was provided, so exploitation probability cannot be quantified from the input; status is 'no public exploit identified at time of analysis.' The realistic risk is meaningful but gated: an attacker cannot act autonomously and must socially engineer a logged-in admin, so this is a targeted/opportunistic issue rather than a mass-exploitable RCE. Note the CPE is a placeholder ('cpe:2.3:a:n/a:n/a') and CWE is marked N/A in the input, so affected-version boundaries beyond '3.5.0-SNAPSHOT and earlier' are not machine-verifiable - verify the exact fixed release against the xuxueli/xxl-job repository. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page (or email link) that auto-submits a request to /user/insert on a victim organization's XXL-JOB admin console. When a currently-authenticated XXL-JOB administrator visits the page, their browser silently issues the request using their session, creating a new administrative user the attacker controls. No public exploit is identified in the provided data, but the lack of HTTP-method restriction makes a trivial GET-based or auto-submitting-form PoC straightforward to build. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Cross-site request forgery in XXL-JOB 3.5.0-SNAPSHOT and earlier lets an attacker riding an authenticated administrator's browser session create, modify, or delete console user accounts through the unprotected /user/insert, /user/update, and /user/delete endpoints in JobUserController. The flaw is scored CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no attacker privileges are required, but success depends entirely on a logged-in admin being lured into visiting an attacker-controlled page, since the endpoints carry no anti-CSRF token and do not restrict HTTP method. No public exploit code and no CISA KEV entry were identified at time of analysis, and the practical impact is limited to user-management state (account creation, privilege changes, and deletion) on admin consoles that are reachable from the victim's browser.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be compensating until an upstream fix is published; note also that the reported affected version string is a development snapshot, so administrators should verify their exact build against the upstream project (https://github.com/xuxueli/xxl-job) and the write-up at https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md before concluding they are unaffected. Highest-value mitigation is to require a SameSite=Lax or SameSite=Strict attribute on the console's session cookie (or apply it at the reverse proxy), which prevents the victim's browser from attaching credentials to cross-site requests; the trade-off is that Strict can break legitimate cross-site entry links into the console, while Lax still blocks cross-site POSTs and cross-site subresource GETs. Second, add CSRF protection to the three endpoints - enable the Spring Security CsrfFilter (or an equivalent per-session token) and restrict /user/insert, /user/update, and /user/delete to POST with a validated token, with the side effect that any scripted or API clients calling these routes must be updated to send the token. Third, blunt the attack surface by enforcing an Origin/Referer allow-list check for state-changing console requests at the reverse proxy, and by placing the admin console behind a management network, VPN, or IP allow-list so that an attacker-controlled page loaded by an administrator cannot reach it at all - the trade-off being reduced administrator mobility. Finally, train administrators not to browse arbitrary sites with an active XXL-JOB session and to log out when leaving the console; no exploit code was observed in the available intelligence, but the technique is generic and low-cost for attackers to reproduce.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XXL-JOB is a Java-based distributed task-scheduling platform whose web admin console (Spring MVC controllers such as JobUserController) exposes state-changing administrative operations. The root cause is CWE-352 (Cross-Site Request Forgery): the /user/insert, /user/update, and /user/delete handlers perform privileged user-management actions based solely on the ambient session cookie, without validating a per-request anti-CSRF token and without enforcing an HTTP method (no POST-only mapping or equivalent restriction). Because there is no Origin/Referer or token check in the request path, a cross-origin page can issue simple GET or form-based requests that the browser automatically attaches the admin's session cookie to, causing the console to act as the administrator. The Spring Security CSRF filter (or an equivalent custom token mechanism) is evidently not applied to these routes; deployments relying only on cookie-scoped session authentication, especially without SameSite cookie attributes, are exposed. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a) and provides no additional product granularity beyond the description's version range.
Know when Xxl Job gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Classic CSRF: no attacker privileges (PR:N) but mandatory admin interaction (UI:R); forging admin user create/update/delete yields full account control, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.
Executive ViewAI
XXL-JOB, the open-source distributed job scheduler used to orchestrate scheduled tasks across our infrastructure, ships with console user-management endpoints that lack cross-site request forgery protections in version 3.5.0-SNAPSHOT and all earlier releases. An attacker who persuades a logged-in XXL-JOB administrator to open a malicious web page can silently create, modify, or delete console accounts - including elevating privileges - without ever authenticating to the product. Because the affected accounts govern who can schedule, modify, and execute jobs across connected systems, this represents a direct path to unauthorized control over job execution and to persistence inside the scheduling tier; leadership should care because no vendor patch currently exists and mitigation depends on restricting who can reach the admin console.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict XXL-JOB admin console reachability to trusted management networks/VPNs with source allow-listing; enforce SameSite=Strict (or Lax) plus Secure and HttpOnly on session cookies; block or validate cross-origin requests to /user/insert, /user/update, and /user/delete at the reverse proxy or WAF; require re-authentication or step-up confirmation for user-management actions; isolate administrator browsing from general web use; and monitor console audit logs for anomalous account creation, privilege changes, or deletions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. Rated critical severity (CVSS 9.8),
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. Rated critical severity (CVSS 9.8), this vulner
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another use
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Tas
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control ex
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save. Rated high severity (C
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive infor
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Rated medium severity (CVSS 6.5),
This affects all versions of the package com.xuxueli:xxl-job. Rated medium severity (CVSS 6.1), this vulnerability is re
XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/j
Exploit-DB