CVE-2026-65316: xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

Published Jul 21, 2026

Updated

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

Affected Software

1 affected component

XXL-Job XXL-Job=2.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade xxl-job to a version that resolves this vulnerability.
Fixed in 2.4.2

Event History

Jul 21, 2026

CVE Published

via MITRE·09:23 PM

Data Sourced

via MITRE·09:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated XXL-Job user with access to the affected instance can exploit it. The attacker does not need access to the job group whose logs they want to read.

What access and actions are required for exploitation?

The attacker needs a valid authenticated account and must call the /joblog/logDetailCat endpoint with logId values. Sequential log IDs can be incremented to enumerate log records across job groups.

Are all affected deployments exposed by default?

The issue affects XXL-Job version 2.4.2 because /joblog/logDetailCat lacks the authorization check present in /joblog/logDetailPage. Any deployment where authenticated users can reach that endpoint may expose restricted job-group log content.

How can defenders identify possible exploitation?

Review requests to /joblog/logDetailCat for repeated or sequential logId parameter values, especially from users accessing logs outside their assigned job groups. Compare those requests with the requester’s authorized job-group permissions.

CVE-2026-65316: xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and actions are required for exploitation?

Are all affected deployments exposed by default?

How can defenders identify possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and actions are required for exploitation?

Are all affected deployments exposed by default?

How can defenders identify possible exploitation?