CVE-2026-58375

Name of the Vulnerable Software and Affected Versions JimuReport versions prior to 2.5.1

Description The application exposes the POST '/jmreport/auto/export' endpoint without authentication because the handler is annotated with @JimuNoLoginRequired, causing the JimuReportTokenInterceptor to skip authentication and authorization checks. Additionally, the export service streams rendered reports for any provided report identifier without verifying the auto-export configuration flag. This allows an unauthenticated remote attacker to enumerate Snowflake report identifiers and export the full contents of any report, which may include data from configured SQL queries and credentials embedded in data sources.

Recommendations Update JimuReport to a version newer than 2.5.0. Restrict access to the '/jmreport/auto/export' endpoint to minimize the risk of exploitation.