{"id":"CVE-2026-106708","published":"2026-10-15T20:17:06.420","lastModified":"2026-10-16T19:56:15.773","description":"XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md","tags":[]},{"url":"https://github.com/xuxueli/xxl-job","tags":[]}],"exploitRefs":[{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md","tags":[]},{"url":"https://github.com/xuxueli/xxl-job","tags":[]}],"hasPoc":true,"ai":{"summary":"XXL-JOB's user management endpoints lack CSRF protection, allowing attackers to perform unauthorized user operations like creating, modifying, or deleting accounts without user interaction. This vulnerability enables attackers to hijack user accounts and escalate privileges within the system.","exploitability":"Exploitation is relatively straightforward requiring only a victim to visit a malicious webpage with embedded requests to the vulnerable endpoints, though it depends on the victim having valid session cookies and access to the XXL-JOB application.","blast_radius":"If exploited, attackers could gain full control over user accounts, potentially leading to unauthorized access to scheduled jobs, data manipulation, and privilege escalation across the entire XXL-JOB instance.","remediation":"Apply the patch for XXL-JOB 3.5.0-SNAPSHOT or upgrade to version 3.5.0 or later which includes CSRF protection for the user management endpoints.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","web","user-management","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-18T15:56:02.227Z"}}