Executive brief
JimuReport, a data visualization and reporting tool, contains a security flaw that allows anyone on the network to download sensitive reports without logging in. By accessing a specific unprotected web address, an attacker can export full business reports, which may contain private customer data, financial records, or database credentials. This could lead to significant data breaches and the exposure of internal company information.
Technical details
A missing authentication vulnerability exists in JimuReport through version 2.5.0. The 'POST /jmreport/auto/export' endpoint is incorrectly annotated with '@JimuNoLoginRequired', causing the 'JimuReportTokenInterceptor' to bypass all authentication and authorization checks. Furthermore, the underlying service fails to verify the 'auto-export' configuration flag before processing requests. An unauthenticated remote attacker can exploit this by providing a targeted Snowflake report identifier to the endpoint, allowing them to download the rendered report in formats like Excel. This results in the unauthorized disclosure of SQL query results and potentially sensitive credentials stored within the report's data sources.
Affected products
- jeecgboot JimuReport through 2.5.0
Timeline
- 2026-06-03: disclosed: Vulnerability reported to vendor via email
- 2026-06-17: other: Public GitHub issue opened
- 2026-06-30: advisory: NVD and VulnCheck advisories published