High severity · published Aug 17, 2026
CVE-2026-75479
JimuReport Unauthenticated Report Listing and Share Token Disclosure
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
jimureport · jeecgboot
through 2.3.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75479
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75479
github.com
https://github.com/jeecgboot/jimureport
github.com
https://github.com/jeecgboot/jimureport/issues/4695
www.vulncheck.com
https://www.vulncheck.com/advisories/jimureport-unauthenticated-report-listing-and-share-token-disclosure
More from jimureport
7.5
CVE-2026-58375
JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
4.7
CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection