Insecure Direct Object Reference in XXL-Job by Xuxueli

CVE-2026-65316

What is CVE-2026-65316?

XXL-Job version 2.4.2 is vulnerable to an insecure direct object reference issue that enables authenticated users to access sensitive execution log data from unauthorized job groups. By incrementing the log ID parameter at the logDetailCat endpoint, attackers can bypass existing permission checks and enumerate log records from restricted job groups, potentially exposing confidential information. This vulnerability raises significant security concerns, particularly for environments relying on secure job management.

References