Skip to main content

JimuReport EUVDEUVD-2026-60391

| CVE-2026-75479 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-08-17 VulnCheck GHSA-gvmm-h58c-795c
Authentication Bypass Jimureport
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-accessible unauthenticated endpoint (PR:N, AV:N, AC:L); confidentiality-only impact (C:H) with no integrity or availability consequence and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 21:08 vuln.today
CVE Published
Aug 17, 2026 - 20:36 cve.org
HIGH 8.7

DescriptionCVE.org

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

AnalysisAI

Unauthenticated access to JimuReport's report folder template listing endpoint exposes all report definitions, share tokens, embedded SQL statements, and live query data to any remote attacker. The CWE-306 root cause - missing authentication for a critical function - means the disclosure requires no credentials, no user interaction, and no special tooling. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send unauthenticated GET to listing endpoint
Delivery
Enumerate all report folders and templates
Exploit
Extract share tokens from API response
Execution
Authenticate to protected report endpoints using disclosed tokens
Persist
Download full report definitions with embedded SQL
Impact
Exfiltrate live query data and database schema details
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required beyond network reachability to the JimuReport web application. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) is internally consistent with the description: network-reachable, low complexity, zero prerequisites, high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An external attacker sends an unauthenticated HTTP GET request to JimuReport's report folder template listing endpoint, receiving a response containing report names, folder structures, and share tokens. The attacker then uses the disclosed share tokens to authenticate to protected report endpoints, downloading full report definitions - including embedded SQL queries that may expose database schema, table names, and production data - without ever obtaining valid user credentials.
Remediation No vendor-released patch has been identified at time of analysis; the vulnerability is disclosed via GitHub issue https://github.com/jeecgboot/jimureport/issues/4695, which should be monitored for an upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an inventory of all JimuReport deployments and identify any instances reachable from the internet or untrusted networks, immediately implementing firewall rules to restrict access to the vulnerable endpoint. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jimureport

View all
CVE-2025-66913 CRITICAL POC
9.8 Jan 08

JimuReport through 2.1.3 has RCE via user-controlled H2 JDBC URLs. The application passes attacker-supplied JDBC connect
CVE-2024-44893 CRITICAL POC
9.8 Sep 10

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via
CVE-2023-4450 CRITICAL POC
9.8 Aug 21

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2026-58375 HIGH POC
8.7 Jun 30

Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
CVE-2023-6307 CRITICAL
9.8 Nov 27

A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Rated critical severity (CVSS 9.8)
CVE-2026-5848 LOW POC
2.0 Apr 09

Code injection in JimuReport's Data Source Handler allows authenticated high-privilege users to execute arbitrary code v
CVE-2025-8963 MEDIUM POC
5.3 Aug 14

A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Rated medium severity (CVSS 5.3), this vulnerability

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-60391 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy