CVE-2025-11580
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
PowerJob up to 5.1.2 contains a missing authorization vulnerability in the list function of the /user/list file. Manipulation of this function allows unauthorized access to the user list. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.
Risk Assessment
A remote attacker can access the user list without authorization, potentially leading to further attacks such as brute force or phishing. The risk affects organizations using PowerJob.
Recommendation
Upgrade PowerJob to a version later than 5.1.2 if available. Until patched, restrict access to the /user/list endpoint.
Other vulnerabilities in PowerJob
See all- CVE-2026-75429Critical
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer.
- CVE-2023-37754Critical
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
- CVE-2026-82630High
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-5739High
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.
- CVE-2026-5736High
In PowerJob 5.1.0/5.1.1/5.1.2, the detailPlus endpoint in InstanceController.java is vulnerable to SQL injection via the customQuery argument. Remote exploitation is possible. The project was notified but has not responded.
- CVE-2025-14518Medium
A vulnerability was identified in PowerJob up to 5.1.2, affecting the function checkConnectivity in the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the Network Request Handler component. Manipulation of the targetIp/targetPort arguments leads to server-side request forgery (SSRF).
- CVE-2025-11581Medium
A security vulnerability has been detected in PowerJob up to 5.1.2 affecting the /openApi/runJob file of the OpenAPIController component, leading to missing authorization. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2023-36106High
CVE-2023-36106 describes an incorrect access control vulnerability in powerjob version 4.3.2 and earlier, allowing remote attackers to obtain sensitive information via the querying interface using the appId parameter to /container/list.
Original NVD description (English source)
A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS