CVE-2026-65316

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/xuxueli/xxl-job
https://github.com/xuxueli/xxl-job/issues/3983
https://www.vulncheck.com/advisories/xxl-job-cross-job-group-log-disclosure-via-missing-authorization-check-in-joblog-logdetailcat

Configurations

No configuration.

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) XXL-Job versión 2.4.2 contiene una vulnerabilidad de referencia directa a objeto insegura que permite a usuarios autenticados leer contenido de registros de ejecución de grupos de trabajos a los que no están autorizados a acceder al proporcionar IDs de registro secuenciales arbitrarios al endpoint logDetailCat. Los atacantes pueden enumerar registros de log en todos los grupos de trabajos al llamar al endpoint logDetailCat con valores de parámetro logId incrementados, eludiendo la verificación de permisos presente en el endpoint hermano logDetailPage, y recuperar contenido de log sensible de grupos de trabajos restringidos.

Information

Published : 2026-07-21 22:19

Updated : 2026-10-24 17:10

NVD link : CVE-2026-65316

Mitre link : CVE-2026-65316

CVE.ORG link : CVE-2026-65316

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-65316", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65316", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T18:29:31.255251Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "xuxueli", "product": "xxl-job", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.2"}], "defaultStatus": "affected"}]}], "published": "2026-07-21T22:19:10.197", "references": [{"url": "https://github.com/xuxueli/xxl-job", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/xuxueli/xxl-job/issues/3983", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/xxl-job-cross-job-group-log-disclosure-via-missing-authorization-check-in-joblog-logdetailcat", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups."}, {"lang": "es", "value": "XXL-Job versi\u00f3n 2.4.2 contiene una vulnerabilidad de referencia directa a objeto insegura que permite a usuarios autenticados leer contenido de registros de ejecuci\u00f3n de grupos de trabajos a los que no est\u00e1n autorizados a acceder al proporcionar IDs de registro secuenciales arbitrarios al endpoint logDetailCat. Los atacantes pueden enumerar registros de log en todos los grupos de trabajos al llamar al endpoint logDetailCat con valores de par\u00e1metro logId incrementados, eludiendo la verificaci\u00f3n de permisos presente en el endpoint hermano logDetailPage, y recuperar contenido de log sensible de grupos de trabajos restringidos."}], "lastModified": "2026-10-24T17:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}