CVE-2026-75479

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-75488.8A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cg CVE-2026-754806.5OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticat CVE-2026-754818.8SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Att CVE-2026-754827.5SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory dir CVE-2026-754833.3powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers CVE-2026-754846.9Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to sm CVE-2026-754855.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in r CVE-2026-754868.0Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuratio CVE-2026-75497.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?acti CVE-2026-754967.2Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible CVE-2026-754977.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges CVE-2026-754987.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges