CVE-2026-65316

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65316
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65316.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65316
Published
2026-07-21T21:23:55.384Z
Modified
2026-07-23T04:03:03.749562963Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat
Details

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65316.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/xuxueli/xxl-job

Affected ranges

Type
GIT
Repo
https://github.com/xuxueli/xxl-job
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
00ba39919cbf753fb5d75b9e700afc36ec87eee9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0.0
2.*
2.0.2
2.1.0
2.1.1
2.1.2
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
v1.*
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1
v2.*
v2.0.0
v2.0.1
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65316.json"