CVE-2026-75479: JimuReport Unauthenticated Report Listing and Share Token Disclosure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-10-23
Weakness: CWE-306

Description

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

Affected products

jeecgboot JimuReport: through 2.3.4

References

https://github.com/jeecgboot/jimureport
https://github.com/jeecgboot/jimureport/issues/4695
https://www.vulncheck.com/advisories/jimureport-unauthenticated-report-listing-and-share-token-disclosure
https://github.com/jeecgboot/jimureport/issues/4695

Get alerted when CVE-2026-75479 or the next vulnerability affects your stack