CVE-2026-75415
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.
Risk Assessment
An attacker can impersonate any user, including an administrator, potentially leading to unauthorized access to sensitive data and system integrity compromise.
Recommendation
Change the identity verification mechanism to not rely on request headers, but use secure sessions or authentication tokens.
Other vulnerabilities in AntFlow
Original NVD description (English source)
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.