Loading story…
JeecgBoot through version 3.9.2 contains a high-severity broken access control flaw tracked as CVE-2026-58377 that lets authenticated low-privilege users fully manage OpenAPI credentials. The affected /openapi/auth/* and /openapi/permission/* endpoints reportedly lack required Shiro authorization annotations, allowing create, read, update, and delete actions against stored AK/SK pairs. Reports say the credential list endpoint returns secret keys in plaintext, exposing sensitive credentials that can be stolen and reused to access the platform's OpenAPI functionality.
A related JeecgBoot issue indicates the impact extends beyond credential disclosure: the public /openapi/call/{path} handler allegedly accepts an appkey header without validating the expected secret-key signature, allowing attackers to invoke configured API routes after obtaining any key pair and potentially receive a JWT for the credential owner, including an administrator. Separately, a vulnerability report for JimuReport 2.3.4, part of the JeecgBoot ecosystem, says the POST /jmreport/auto/export endpoint can export report data without authentication because it is marked @JimuNoLoginRequired, creating additional exposure of business data, PII, and embedded credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-58377 was published for a high-severity broken access control vulnerability affecting JeecgBoot through version 3.9.2. The advisory said authenticated low-privilege users can perform full CRUD operations on OpenAPI credentials and obtain plaintext secret keys because the affected endpoints lack Shiro authorization annotations.
A GitHub issue reported that JeecgBoot's OpenAPI module lacks authorization checks on credential-management endpoints under /openapi/auth/* and /openapi/permission/*, allowing any authenticated user to read, modify, or delete AK/SK credentials. The same report said /openapi/call/{path} accepts only an appkey and does not verify the SK-based signature, enabling unauthorized API calls and possible impersonation of credential owners.
A vulnerability report disclosed that JimuReport 2.3.4 allows unauthenticated users to export report contents via POST /jmreport/auto/export because the endpoint bypasses authentication and authorization checks. The report said attackers could enumerate report IDs and retrieve ZIP archives containing potentially sensitive business data, PII, and credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical command injection flaw tracked as **`CVE-2024-43028`** was disclosed for **Jeecg Boot** versions **3.0.0 through 3.5.3**, affecting the **`/jmreport/show`** component. The vulnerability is classified as **CWE-77** and can let unauthenticated remote attackers execute arbitrary code through a crafted HTTP request. Its CVSS v3.1 vector, **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicates full compromise potential across confidentiality, integrity, and availability. A separate high-severity issue, **`CVE-2026-42524`**, was reported in the **Jenkins HTML Publisher Plugin** version **427 and earlier**. The bug is a **stored XSS** vulnerability (**CWE-79**) caused by improper escaping of job names and URLs in the plugin’s legacy wrapper file, and it can be exploited by attackers with **Item/Configure** permission. The flaw carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`**, and Jenkins has published a related security advisory for affected users.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-58375`** affects **JimuReport through version 2.5.0**, allowing unauthenticated remote attackers to access the `POST /jmreport/auto/export` endpoint and export report contents without logging in. The issue stems from the endpoint being annotated with **`@JimuNoLoginRequired`**, which causes **`JimuReportTokenInterceptor`** to skip authentication and authorization checks. Researchers said the export service also does not verify the auto-export configuration flag before returning data, enabling attackers to enumerate Snowflake report identifiers and retrieve arbitrary report contents. Exposed data can include **SQL query results** and **credentials embedded in report data sources**, creating a significant information disclosure risk. The flaw is rated **8.7 CVSS 4.0** and **7.5 CVSS 3.1**, and organizations using JimuReport are advised to update to a patched or latest available version and review access controls on sensitive endpoints.
Jun 30, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026