Vulnerability · Published Sep 12, 2026 · Assigned by VulDB

CVE-2026-90487Xuxueli xxl-job JobGroupController.java privileges management

Medium 4.3

In plain English

A medium-severity privilege mismanagement in xxl-job from Xuxueli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Xuxueli	xxl-job	3.4.03.4.13.4.2

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-403075 | Xuxueli xxl-job JobGroupController.java privileges management vdb-entry
VDB-403075 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90487 | CVE Analysis and Report third-party-advisory
Submit #888438 | xuxueli XXL-JOB 3.4.2 Improper Privilege Management third-party-advisory
https://github.com/zhaizejiang/xxl-job-vuln-poc/edit/main/xxl-job3.4.2_loadById%20Endpoint%20Missing%20Authentication.md exploit