CVE-2026-65316 in xxl-job
Summary
by MITRE • 07/22/2026
XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The XXL-Job 2.4.2 insecure direct object reference vulnerability represents a critical authorization bypass flaw that undermines the system's access control mechanisms. This vulnerability specifically affects the logDetailCat endpoint which fails to properly validate user permissions when processing log ID requests. The flaw allows authenticated users to circumvent normal access controls by directly referencing log records through sequential ID parameters, effectively enabling unauthorized data enumeration and disclosure across job groups they should not have access to. The vulnerability exists because the system does not implement proper authorization checks before serving log content, unlike the logDetailPage endpoint which correctly enforces permissions.
The technical implementation of this vulnerability stems from improper input validation within the logDetailCat endpoint logic. When users submit requests with incremented logId parameter values, the system processes these requests without verifying whether the requesting user has appropriate privileges to access the specified job group's logs. This direct object reference pattern exposes the underlying data structure to unauthorized access, as the system treats the log ID as a direct pointer to database records rather than validating access rights first. The vulnerability demonstrates a classic insecure direct object reference weakness that falls under CWE-639, which specifically addresses authorization checks for indirect object references.
The operational impact of this vulnerability extends beyond simple information disclosure, creating potential risks for organizations relying on XXL-Job for job scheduling and monitoring. Attackers can systematically enumerate log records across all job groups by simply incrementing the logId parameter values, potentially exposing sensitive operational data including system configurations, job execution details, and other confidential information. This enumeration capability enables adversaries to gather intelligence about system operations, identify potential attack vectors, and understand the internal structure of job scheduling processes. The vulnerability particularly affects environments where job groups contain different levels of sensitive data or where access controls are meant to isolate different operational domains.
From a security framework perspective, this vulnerability directly relates to ATT&CK technique T1074.001 which covers data staging through local data staging and can be categorized under the broader category of credential access and privilege escalation. Organizations implementing XXL-Job should immediately address this issue by ensuring proper authorization checks are enforced before serving log content regardless of the endpoint used. The recommended mitigation involves implementing robust permission validation logic that verifies user access rights against job group ownership before returning any log data. Additionally, organizations should consider implementing rate limiting and monitoring mechanisms to detect anomalous enumeration patterns that could indicate exploitation attempts. The vulnerability underscores the importance of maintaining consistent authorization controls across all API endpoints and demonstrates how seemingly minor implementation oversights can create significant security risks in enterprise scheduling systems.