Description

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T21:16:50.333Z",
  "pubdate": "2026-08-17T21:16:50.333Z",
  "executiveSummary": "JimuReport suffers from a critical authentication bypass vulnerability residing within the report folder template listing endpoint. This security flaw allows unauthenticated remote attackers to completely bypass access control mechanisms and interact directly with sensitive reporting functions. The primary impact of this vulnerability encompasses the unauthorized enumeration of all configured reports and the unauthorized retrieval of associated share tokens.\nBy successfully leveraging the exposed share tokens, malicious actors gain the capability to query protected report endpoints without supplying valid credentials. This leads directly to the unauthorized disclosure of full report definitions, which structurally contain embedded SQL statements and potentially sensitive live query data. The risk implications are severe, as exposed database queries and live data expose underlying database architectures and operational data to unauthorized third parties.\nExploitation of this vulnerability requires network access to the affected JimuReport instance and does not mandate any prior authentication or special user privileges. The attack vector is entirely network-based, allowing automated discovery and data exfiltration at scale. Remediation requires implementing strict authentication and authorization checks on the report folder template listing endpoint and invalidating exposed share tokens.",
  "technicalDetails": "The vulnerability stems from a fundamental flaw in access control enforcement within the JimuReport application architecture. Specifically, the report folder template listing endpoint fails to validate whether incoming HTTP requests originate from authenticated and authorized users. As a result, the application processes browsing and listing requests from unauthenticated network entities.\nThe attack flow proceeds in a deterministic sequence. First, an unauthenticated attacker transmits a direct HTTP request to the vulnerable report folder template listing endpoint over the network. Because the underlying routing and controller logic lacks proper session validation or token verification, the application bypasses security gates and processes the request.\nSecond, the endpoint responds by returning a comprehensive enumeration of all report folders and templates managed by the system. Embedded within this response payload are cryptographic or sequential share tokens associated with individual reports.\nThird, armed with these disclosed share tokens, the attacker executes post-exploitation enumeration. The attacker submits requests to protected report endpoints utilizing the harvested share tokens. The application accepts the share tokens as valid surrogates for authentication, granting the attacker full access to restricted report views.\nFinally, the protected endpoints return the full report definitions to the attacker. These definitions frequently contain embedded SQL statements, database connection parameters, and live query results generated during report execution. This exposes critical business logic, database schemas, and sensitive operational data to external adversaries without requiring administrative privileges, zero-day code execution, or complex payload delivery mechanisms."
}