CVE-2026-65316
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.
Risk Assessment
Attackers can enumerate logs from all job groups and access sensitive information contained in logs, such as data processed by jobs.
Recommendation
Update XXL-Job to a version that fixes permission checks in the logDetailCat endpoint.
Other vulnerabilities in XXL-Job
See all- CVE-2026-52371Medium
xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.
- CVE-2023-33779High
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.
Original NVD description (English source)
XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.