Unauthenticated Report Export in JimuReport

Executive Summary

CVE-2026-58375 is a critical vulnerability in JimuReport version 2.5.0 and earlier that allows unauthenticated remote attackers to export reports via the unprotected POST /jmreport/auto/export endpoint.

The vulnerability exists because the endpoint is annotated with @JimuNoLoginRequired, which causes the JimuReportTokenInterceptor to skip all authentication and authorization checks.

As a result, an attacker can enumerate Snowflake report identifiers and export the full contents of any report, including sensitive data returned by SQL queries and any credentials embedded in the report's data sources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthenticated access to the POST /jmreport/auto/export endpoint on JimuReport versions up to 2.5.0. An attacker can send a POST request with a report ID to this endpoint without any authentication token or cookie and receive the exported report data.

A simple command to test this would be using curl to send a POST request to the endpoint with a report ID parameter and observe if the report data is returned without authentication.

• curl -X POST http://<target-host>/jmreport/auto/export -d 'reportId=<report_id>' -v

If the response contains a ZIP file or report data without requiring authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to access and export sensitive report data without any authorization.

• Attackers can obtain business information, personally identifiable information (PII), and embedded credentials from the reports.
• The exported data is streamed as a ZIP file containing an Excel file, which can be used for further exploitation or data leakage.

Such unauthorized data exposure can lead to data breaches, loss of confidentiality, and potential misuse of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote attackers to export full report contents, including sensitive data such as business information, personally identifiable information (PII), and embedded credentials.

Exposure of such sensitive data without authentication can lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Because the vulnerability bypasses authentication and authorization, it undermines the confidentiality and security requirements mandated by these regulations, potentially resulting in non-compliance and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing the @JimuNoLoginRequired annotation from the /jmreport/auto/export endpoint to enforce authentication and authorization checks.

Alternatively, if unauthenticated access is necessary, implement a secure API key or HMAC mechanism to protect the endpoint.

Additionally, upgrading JimuReport to a version where this vulnerability is fixed or applying patches that enforce authentication on this endpoint is recommended.

Useful 0 Not Useful 0