CVE-2026-26718

Published: Jul 15, 2026Modified: Jul 16, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (3)

https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Source: cve@mitre.org

https://xxl-job-admin.com

Source: cve@mitre.org

https://github.com/Ibrahim-Sartawi/CVE-2026-26718

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.