CVE-2026-107779

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
dromara	skyeye	<= 003549ae5615bd114ba5bb8ddf6a8e8ead97c321

References

Timeline

Published: Oct 8, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1077809.8Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated CVE-2026-1077817.4Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vuln CVE-2026-1077827.8System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to re CVE-2026-1077835.9Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's CVE-2026-1077856.3Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of CVE-2026-1077866.8The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL CVE-2026-1077873.1The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role CVE-2026-1077884.3The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any au CVE-2026-1077895.3The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unaut CVE-2026-107794.3The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up CVE-2026-1077906.8The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard CVE-2026-1077916.5The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-delet