CVE-2026-58375: JimuReport Auth Bypass Vulnerability

CVE-2026-58375 Overview

CVE-2026-58375 is a missing authentication vulnerability [CWE-306] affecting JimuReport through version 2.5.0. The POST /jmreport/auto/export endpoint is annotated with @JimuNoLoginRequired, causing JimuReportTokenInterceptor to skip authentication and authorization checks. The export service streams rendered reports for any supplied report identifier without verifying the auto-export configuration flag. Unauthenticated remote attackers can enumerate Snowflake report identifiers and export the full contents of any report, including results of configured SQL queries and credentials embedded in report data sources.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary report contents and embedded data source credentials from JimuReport instances exposed to the network.

Affected Products

JimuReport through version 2.5.0
Deployments exposing the /jmreport/auto/export endpoint to untrusted networks
Applications embedding JimuReport with default interceptor configuration

Discovery Timeline

2026-06-30 - CVE-2026-58375 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58375

Vulnerability Analysis

The vulnerability resides in the JimuReport auto-export handler for the POST /jmreport/auto/export route. The handler carries the @JimuNoLoginRequired annotation, which instructs JimuReportTokenInterceptor to bypass all authentication and authorization logic for the request. The export service then processes the supplied report identifier and streams the rendered report content back to the caller.

The handler does not validate whether the target report has auto-export enabled in its configuration. Any report ID accepted by the backend, including Snowflake-generated identifiers, yields a complete render. That render includes rows returned by the report's configured SQL queries against connected databases.

Rendered output also contains data source metadata. Where JimuReport stores credentials directly in report definitions, those credentials appear in the exported payload. Attackers can pivot from a single exposed instance to the underlying databases referenced by report data sources.

Root Cause

The root cause is a missing authorization check [CWE-306] on a sensitive server-side data export function. The annotation-driven interceptor treats the endpoint as public, and the service layer does not enforce a secondary authorization gate or verify the auto-export configuration flag on the requested report.

Attack Vector

Exploitation is network-based, requires no authentication, and requires no user interaction. An attacker sends a crafted POST request to /jmreport/auto/export with an enumerated or guessed report identifier. Snowflake identifier structure allows systematic enumeration. See the VulnCheck Advisory on JimuReport and the GitHub Issue Discussion for additional technical detail.

Detection Methods for CVE-2026-58375

Indicators of Compromise

Unauthenticated POST requests to /jmreport/auto/export in web server or reverse proxy logs
Sequential or scripted requests iterating through numeric or Snowflake-style report identifiers
Large outbound HTTP response payloads originating from JimuReport worker processes
Access to the export endpoint from source IPs that have not authenticated to /jmreport/login

Detection Strategies

Alert on any request to /jmreport/auto/export lacking an authenticated session cookie or bearer token
Correlate export endpoint access with the absence of prior authentication events from the same source
Baseline normal export volume per report ID and flag statistical outliers

Monitoring Recommendations

Ingest JimuReport application logs and upstream reverse proxy access logs into a central SIEM
Track database query volume from JimuReport service accounts for unexpected spikes
Monitor for outbound egress from JimuReport hosts to unfamiliar destinations following export activity

How to Mitigate CVE-2026-58375

Immediate Actions Required

Restrict network access to /jmreport/auto/export using a reverse proxy or web application firewall until an upstream fix is applied
Remove or rotate any credentials embedded in JimuReport data source definitions, as they must be considered exposed
Audit report definitions and databases for evidence of unauthorized query execution or data access
Review the GitHub Issue Discussion for vendor guidance and fix status

Patch Information

No vendor patch is referenced in the enriched CVE data at time of publication. Track the VulnCheck Advisory on JimuReport and the upstream JimuReport project for a fixed release beyond version 2.5.0.

Workarounds

Block or require authentication for /jmreport/auto/export at the reverse proxy layer
Remove the @JimuNoLoginRequired annotation on the auto-export handler in local builds, or override JimuReportTokenInterceptor to enforce authentication on this route
Store data source credentials in an external secrets manager rather than embedding them in report definitions
Place JimuReport instances behind VPN or zero trust network access controls to remove internet exposure

bash

# Example nginx rule to require authentication on the vulnerable endpoint
location = /jmreport/auto/export {
    auth_request /auth;
    proxy_pass http://jimureport_backend;
}