---
id: CVE-2026-58375
title: JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
summary: >-
  JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint
  without authentication: the handler is annotated @JimuNoLoginRequired, so
  JimuReportTokenInterceptor skips all authentication and authorization, and the
  export serv…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: jeecgboot
product: jimureport
affected:
  - jimureport <= 2.5.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-01T14:44:42.547544Z'
exploitAvailable: true
published: '2026-06-30'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:58.808Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58375'
references:
  - url: 'https://github.com/jeecgboot/jimureport/issues/4694'
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/jimureport-unauthenticated-report-export-via-jmreport-auto-export
tags:
  - cve.org
  - exploit-available
epss: 0.00633
epssPercentile: 0.50632
ingestedAt: '2026-11-08T14:51:22.298Z'
---

## Overview

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.

## Affected

- `jimureport <= 2.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.