CVE-2026-65316: XXL-Job Auth Bypass Vulnerability

CVE-2026-65316 Overview

CVE-2026-65316 is an Insecure Direct Object Reference (IDOR) vulnerability in XXL-Job version 2.4.2. The flaw resides in the logDetailCat endpoint of the JobLogController, which fails to enforce the authorization check present in the sibling logDetailPage endpoint. Authenticated users can supply arbitrary sequential logId values and retrieve execution log content from job groups they are not permitted to access. The weakness is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key) and enables horizontal privilege escalation across tenant boundaries within a shared XXL-Job scheduler deployment.

Critical Impact
Any authenticated XXL-Job user can enumerate logId values to read execution logs from restricted job groups, exposing sensitive command output, parameters, and operational data.

Affected Products

XXL-Job version 2.4.2
Deployments exposing the JobLogControllerlogDetailCat endpoint
Multi-tenant XXL-Job admin consoles relying on job group access controls

Discovery Timeline

2026-07-21 - CVE-2026-65316 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-65316

Vulnerability Analysis

XXL-Job is a distributed task scheduling platform that partitions jobs into logical job groups with per-user access controls. The admin console exposes two endpoints for retrieving execution log content: logDetailPage and logDetailCat. The logDetailPage handler validates that the requesting user has permission to access the job group associated with a given log record. The logDetailCat handler, which streams incremental log content by logId and fromLineNum, does not replicate this permission check.

Because logId values are sequential integers assigned at execution time, an authenticated attacker can iterate through the ID space and request log content for records owned by arbitrary job groups. The response returns raw log output, which frequently contains job parameters, shell command output, stack traces, connection strings, and other operational data. See the VulnCheck Security Advisory for the underlying analysis.

Root Cause

The root cause is a missing authorization check in the logDetailCat controller method. Authorization logic was implemented at the sibling endpoint but not applied consistently across all handlers that dereference a logId. The application trusts the client-supplied identifier without cross-referencing the caller's job group membership.

Attack Vector

The attacker requires only low-privileged authenticated access to the XXL-Job admin console. Exploitation is performed over the network by issuing HTTP POST requests to /joblog/logDetailCat with an incremented logId parameter and observing the returned log text. No user interaction and no elevated privileges are required. Refer to the vulnerability discussion in GitHub Issue #3983 for reproduction context.

Detection Methods for CVE-2026-65316

Indicators of Compromise

Sequential or bulk HTTP POST requests to /joblog/logDetailCat from a single authenticated session
Requests to logDetailCat with logId values that do not correspond to any job group the requesting user manages
Elevated volume of logDetailCat responses returning 200 OK to non-administrative user accounts

Detection Strategies

Instrument the XXL-Job admin application to log the caller identity, requested logId, and resolved job group for every logDetailCat call, then alert on cross-group access
Correlate logDetailCat request patterns against expected job group membership defined in the XXL-Job user table
Compare access patterns between logDetailPage and logDetailCat — legitimate users typically reach logDetailCat only after logDetailPage

Monitoring Recommendations

Ingest XXL-Job admin access logs into a centralized log platform and build detections for high-rate logDetailCat enumeration
Alert on any non-admin account accessing more distinct logId values within an hour than the number of jobs in its assigned groups
Monitor for anomalous authenticated sessions issuing requests outside normal working hours or from new source IPs

How to Mitigate CVE-2026-65316

Immediate Actions Required

Inventory all XXL-Job deployments and confirm the running version against 2.4.2
Restrict network access to the XXL-Job admin console to trusted management networks only
Rotate any secrets, tokens, or credentials that may have been printed to job execution logs
Audit user accounts and remove unnecessary low-privileged access to the admin console

Patch Information

No fixed version is referenced in the NVD entry at publication. Track the upstream project at the GitHub XXL-Job Repository and the associated GitHub Issue #3983 for remediation status. Apply the patched release as soon as the maintainer publishes it.

Workarounds

Place the XXL-Job admin console behind an authenticating reverse proxy that enforces additional access control on /joblog/logDetailCat
Add a servlet filter or Spring interceptor that duplicates the logDetailPage authorization check on the logDetailCat handler before requests reach the controller
Limit XXL-Job admin accounts to a minimum set of trusted operators until a vendor patch is available

bash

# Example NGINX rule to restrict logDetailCat to admin source networks
location /joblog/logDetailCat {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://xxljob-admin-upstream;
}