CVE-2026-75978

Deferred Deferred - Pending Action

Permission Issue in EasyReport via QueryerFactory Manipulation

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: VulDB

Description

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75978

EUVD

EUVD-2026-62214

Affected Vendors & Products

Vendor	Product	Version / Range
xianrendzw	easyreport	to 2.0.17.0522_Beta (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-275	Permission Issues
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-75978 is a stored reflection vulnerability in EasyReport up to 2.0.17.0522_Beta. It allows remote code execution (RCE) through a malicious datasource with an arbitrary class name in the queryerClass field. The application uses Class.forName() to load this class without validation, executing its static initializer under the JVM when reports are generated.

Detection Guidance

Check for unauthorized datasources in EasyReport with malicious queryerClass values. Inspect logs for Class.forName() calls with user-controlled inputs. Review network traffic for POST requests to /rest/report/ds/add with suspicious payloads.

Impact Analysis

An authenticated user with report.ds:add permission can exploit this to execute arbitrary code on the server. This could lead to full system compromise, data theft, or further network infiltration. The attack is remote and requires only basic report-management permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, data breaches, and regulatory penalties.

Mitigation Strategies

Restrict queryerClass to an allowlist of built-in queryers. Validate queryerClass at the controller level before persistence. Disable dynamic class loading for user inputs. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-75978. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70