CVE-2026-65316

Received Received - Intake

BaseFortify

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-65316

Affected Vendors & Products

Vendor	Product	Version / Range
xxl-job	xxl-job	2.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-65316 is an insecure direct object reference (IDOR) vulnerability in XXL-Job version 2.4.2. It allows authenticated users to read execution logs from job groups they lack authorization for by manipulating log IDs in the logDetailCat endpoint. Attackers can bypass permission checks by incrementing logId values and retrieve sensitive log content across restricted job groups.

Detection Guidance

To detect this vulnerability, monitor access to the logDetailCat endpoint in XXL-Job 2.4.2. Check for repeated requests with incremented logId values from the same user. Inspect logs for unauthorized access to execution logs across job groups. No specific commands are provided in the context.

Impact Analysis

This vulnerability could expose sensitive job execution logs, including potentially confidential data processed by jobs. Attackers with access to the system could harvest logs from unauthorized job groups, leading to information disclosure. The impact depends on the sensitivity of the data logged by the affected XXL-Job instances.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive data in logs. Organizations using XXL-Job may face regulatory penalties if this flaw leads to data breaches or unauthorized data exposure.

Mitigation Strategies

Immediately upgrade XXL-Job to a patched version beyond 2.4.2. If upgrading is not possible, restrict access to the logDetailCat endpoint via network policies or WAF rules. Review and audit all log access logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-65316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70