CVE-2026-106708: CSRF
Published Oct 15, 2026
·Updated
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.
Affected Software
1 affected component
XXL-Job XXL-Job<=3.5.0-SNAPSHOT
Event History
Oct 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What access or user interaction is required to exploit this issue?
An attacker can target the affected user-management endpoints over the network without prior privileges, but exploitation requires a victim to interact with a crafted request.
2
Which functions are exposed?
The affected endpoints are /user/insert, /user/update, and /user/delete in JobUserController. They lack CSRF protection and do not restrict the HTTP method.
3
Which versions should be treated as affected?
XXL-JOB 3.5.0-SNAPSHOT and earlier are identified as affected. The provided information does not identify a fixed version.