CVE-2026-75339

Deferred Deferred - Pending Action

Unauthenticated File Upload and Download in cjbi admin3

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75339

EUVD

EUVD-2026-67323

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthorized file upload and download issue in the admin3 application (Spring Boot 3.2.3). The storage endpoints lack proper permission checks, allowing any logged-in user—even with zero permissions—to upload arbitrary files. Anonymous attackers can also download these files due to whitelisted paths in the login interceptor.

Detection Guidance

Check for unauthorized file uploads by monitoring the /storage/upload endpoint for unexpected file types or sizes. Verify if files can be downloaded anonymously via /storage/download/** or /storage/fetch/** endpoints. Inspect logs for requests to these paths with missing authentication tokens.

Impact Analysis

An attacker could exploit this by uploading malicious files or downloading sensitive data. They could also delete files without authorization. This could lead to data breaches, system compromise, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Add @RequiresPermissions annotations to /storage/upload, /storage/download, /storage/fetch, and /storage/files/{key} endpoints. Remove whitelisted paths in the login interceptor for these endpoints. Implement strict file type and size validation for uploads. Ensure all storage endpoints require authentication and proper permissions.

Hi! I’m here to help you understand CVE-2026-75339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70