High · 8.8 CVE-2026-106708 EUVD-2026-102426GHSA-4mh8-j9rq-c7hj

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserCon…

Published Oct 15, 2026 · Updated Oct 19, 2026 · Assigned by mitre

Description

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

References

https://github.com/xuxueli/xxl-job
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md