EUVD-2026-76921
GHSA-w26j-6rp4-vhj5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege xxl-job admin credentials
-
DeliveryAuthenticate to admin web interface
-
ExploitSend direct HTTP request to loadById endpoint
-
ExecutionEnumerate executor group IDs sequentially
-
ImpactExtract executor addresses and configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session in the xxl-job admin web interface - the CVSS PR:L metric indicates at least low-privilege credentials are needed, though the POC title ('Missing Authentication') suggests the endpoint may not verify role or ownership. The xxl-job-admin web service must be network-accessible to the attacker. Limiting factors: exploitation is bounded to reading executor group metadata (group name, addresses, registration mode); no write, delete, or code execution capability is indicated. The vendor has not confirmed whether any default login or guest-level access is sufficient, creating ambiguity about the true authentication barrier. |
| Impact | The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) correctly categorizes this as low-severity - the impact is limited to confidentiality of executor group configuration data with no integrity or availability consequences. The E:P supplemental metric confirms a publicly available proof-of-concept, but real-world exploitation risk remains modest given the authentication prerequisite (PR:L) and low data sensitivity. A key discrepancy exists: the POC document title asserts 'Missing Authentication' while the CVSS vector assigns PR:L, implying some session-level access is still required - this should be verified against the actual POC. The 'Privilege Escalation' tag in the input metadata overstates the impact relative to the CVSS metrics, which show read-only access to low-value configuration data. No KEV listing, no EPSS score provided, and vendor non-response increases uncertainty about patch timeline. |
| Exploit ScenarioDerived | An attacker with a valid low-privilege xxl-job admin account sends a direct HTTP GET or POST request to the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the loadById endpoint of JobGroupController.java to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the disclosure. As a compensating control, restrict access to the xxl-job admin interface at the network perimeter so only authorized administrative IP ranges can reach it, reducing exposure to the loadById endpoint. Additionally, implement application-level WAF rules or a reverse proxy with authentication enforcement in front of the admin panel to limit who can issue requests to /jobgroup/loadById. Review and harden xxl-job admin role assignments to ensure that only administrators are granted any login credentials. Monitor VulDB (https://vuldb.com/vuln/403075) and the official xxl-job repository for an upstream patch. Trade-off: network-level restriction does not fix the underlying authorization flaw and does not protect against insider or post-authentication abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
xxl-job is a distributed task scheduling framework for Java/Spring applications, maintained by Xuxueli (cpe:2.3:a:xuxueli:xxl-job). The affected component is JobGroupController.java within the xxl-job-admin module, which manages executor groups - logical groupings of job executors including their addresses and registration modes. CWE-269 (Improper Privilege Management) indicates that the loadById endpoint does not enforce proper role-based access controls, allowing a low-privilege authenticated user to retrieve executor group records by ID. The POC is titled 'loadById Endpoint Missing Authentication,' suggesting the endpoint may perform no meaningful authorization check beyond session presence, consistent with broken object-level authorization (BOLA/IDOR) patterns.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-accessible endpoint requires low-privilege session; impact is read-only access to executor group config with no integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB