CVE-2026-58375CWE-306

JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export

High · published June 30, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-30T15:58Z
EPSS history
Timeline
  • 30 JUN 15:58Z
    JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
    cvelistv5