Junglewise Threat Intelligence

CVE-2026-7303: Xuxueli xxl-job IDOR in Execution Log Handler

CVE-2026-7303 · Severity: low · CVSS 3.7 · Published 2026-04-28

Technologies: Xuxueli XXL-JOB, com.xuxueli:xxl-job-admin (Maven). Vendors: Maven.

Executive brief

A security vulnerability exists in XXL-JOB, a popular distributed task scheduling framework. An authenticated user can bypass group-based access controls to view job execution logs that they are not authorized to see. These logs often contain sensitive business data, internal network addresses, and system secrets, potentially leading to unauthorized information disclosure.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the logDetailCat function within xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java. While the logDetailPage endpoint correctly enforces job-group authorization, the logDetailCat JSON endpoint fails to verify if the requesting user has permissions for the job group associated with a specific logId. A remote authenticated attacker can exploit this by guessing or enumerating log IDs to retrieve execution logs across different job groups. This can result in the disclosure of sensitive operational metadata and secrets. The issue is addressed in version 3.4.0.

Affected products

  • Xuxueli xxl-job up to 3.3.2

Timeline

  • 2026-03-25: disclosed: Issue reported on GitHub repository
  • 2026-04-05: patched: Version 3.4.0 released with fix
  • 2026-04-28: advisory: NVD/VulDB advisory published

References

Related threats