CVE-2026-58375: JimuReport Authentication Bypass Allows Unauthenticated Report Export

Technical summary

JimuReport's export endpoint is protected by the @JimuNoLoginRequired annotation, which causes JimuReportTokenInterceptor to skip all authentication and authorization checks for that handler. The export service then streams the rendered report based solely on a supplied report identifier without verifying whether auto-export is enabled for that report. An unauthenticated attacker can systematically enumerate report IDs and retrieve full report contents, including SQL query results and data source credentials, with a simple POST request.

Business impact

Organizations relying on JimuReport for internal analytics or business intelligence face exposure of sensitive business data and database credentials. If reports contain Snowflake credentials or query results from other data warehouses, attackers gain direct access to those systems. The lack of authentication also means the vulnerability can be exploited from outside the organization if JimuReport is internet-facing, without any prior compromise or insider knowledge. Compliance implications include potential violations of data protection regulations depending on the classification of exposed data.

Affected systems

JimuReport through version 2.5.0 is affected. The vulnerability impacts all deployments of these versions; no specific configuration or optional feature activation is required for exposure. Organizations should check their JimuReport version number against vendor documentation. This is particularly urgent for instances exposed to untrusted networks or the internet.

Exploitability

Exploitability is very high. No authentication, no special privileges, and no user interaction are required. An attacker needs only network access to the JimuReport instance and the ability to guess or enumerate report identifiers. The simplicity of the attack—a POST request with a report ID—means exploitation can be automated and requires minimal technical sophistication.

Remediation

Upgrade JimuReport to a patched version released after 2.5.0. Verify the specific patched version number against the official JimuReport vendor advisory before deployment. As an interim measure if patching is delayed, restrict network access to JimuReport using firewall rules, VPN gating, or reverse proxy authentication to limit exposure to the `/jmreport/auto/export` endpoint specifically. Review exported reports and audit logs for signs of unauthorized access.

Patch guidance

Consult the JimuReport vendor advisory to confirm the patched version number and availability timeline. Plan for testing in a staging environment before production rollout. Patching should be prioritized given the unauthenticated access vector and the sensitivity of data typically held in business intelligence systems. Consider a phased rollout if the patch introduces behavioral changes to report export workflows.

Detection guidance

Monitor for unusual POST requests to `/jmreport/auto/export` from unexpected source IPs or during off-hours. Log and alert on rapid enumeration of report IDs (multiple requests with different identifiers in short timeframes). Review web access logs for unauthenticated access patterns to the export endpoint. If available, enable audit logging in JimuReport to track report access and exports, and correlate those with your authentication logs to identify gaps.

Why prioritize this

This vulnerability earns a HIGH severity rating (CVSS 7.5) due to the combination of unauthenticated remote access (no network segmentation or credentials required), high confidentiality impact (full report and embedded credential exposure), and ease of exploitation. The risk is further elevated because business intelligence and reporting systems are common targets for data exfiltration, and embedded database credentials provide an escalation path to backend data systems.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector (Network) — the vulnerability is exploitable remotely; Attack Complexity (Low) — no special conditions or race conditions required; Privileges Required (None) — no authentication needed; User Interaction (None) — the attacker does not need to trick a user; Confidentiality Impact (High) — full report contents and embedded secrets are exposed; Integrity Impact (None) — the attacker cannot modify reports; Availability Impact (None) — the attack does not degrade service. The absence of integrity and availability impact prevents a critical rating, but the unauthenticated confidentiality breach makes this a serious finding requiring urgent remediation.

Frequently asked questions