CVE-2026-90487

Received Received - Intake

Improper Privilege Management in Xuxueli XXL-JOB

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulDB

Description

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-12

Last Modified

2026-09-12

Generated

2026-09-13

AI Q&A

2026-09-13

EPSS Evaluated

N/A

NVD

CVE-2026-90487

EUVD

EUVD-2026-76921

Affected Vendors & Products

Vendor	Product	Version / Range
xuxueli	xxl-job	to 3.4.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper privilege management issue in Xuxueli xxl-job up to version 3.4.2. It affects the JobGroupController.java file and allows remote attackers to exploit insufficient access controls. The exploit has been publicly disclosed.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The vulnerability involves improper privilege management in Xuxueli xxl-job up to version 3.4.2, but no technical details or detection steps are provided.

Impact Analysis

The vulnerability may allow unauthorized users to gain elevated privileges or perform actions beyond their intended permissions. This could lead to unauthorized access to sensitive data or system functions depending on the affected component.

Compliance Impact

The vulnerability involves improper privilege management in xxl-job, which could allow unauthorized access or control. This may impact compliance with GDPR by potentially exposing personal data without proper authorization, and with HIPAA by risking unauthorized access to protected health information if the system handles such data.

Mitigation Strategies

Immediately upgrade xxl-job to a version beyond 3.4.2 if available. If no patch exists, restrict network access to the JobGroupController component and review user privileges to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-90487. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70