Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-75479JimuReport Unauthenticated Report Listing and Share Token Disclosure
High 7.5
In plain English
A high-severity missing authentication in jimureport from jeecgboot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jeecgboot | jimureport | 0 – through 2.3.4 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue #4695 issue-tracking
- https://github.com/jeecgboot/jimureport product
- VulnCheck Advisory: JimuReport Unauthenticated Report Listing and Share Token Disclosure third-party-advisory