CVE-2026-75479CWE-306

CVE-2026-75479

High · published August 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

39.3

In the wild

Unconfirmed

What it is

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00465 · 39.3th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-08-18T01:16Z

References (4)

https://github.com/jeecgboot/jimureport · [email protected]https://github.com/jeecgboot/jimureport/issues/4695 · [email protected]https://www.vulncheck.com/advisories/jimureport-unauthenticated-report-listing-and-share-token-disclosure · [email protected]https://github.com/jeecgboot/jimureport/issues/4695 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:36Z
JimuReport Unauthenticated Report Listing and Share Token Disclosure
cvelistv5