HIGH 8.8 NVD

CVE-2026-106708

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoin

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

References

https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.md
https://github.com/xuxueli/xxl-job

Published: 2026-10-15 · Source: NVD · Feed updated: 2026-10-15

This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-15 via NVD.

vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.