What is GHSA-cg8w-ggx5-v8p7?

GHSA-cg8w-ggx5-v8p7 is a security advisory published by GitHub Security Advisories with High severity. JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication:...

Which CVE IDs does GHSA-cg8w-ggx5-v8p7 cover?

GHSA-cg8w-ggx5-v8p7 covers the following CVE IDs: CVE-2026-58375. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cg8w-ggx5-v8p7?

GHSA-cg8w-ggx5-v8p7 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-cg8w-ggx5-v8p7HighCVSS 7.5

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication:...

Vendor

GitHub Security Advisories

Published

June 30, 2026

Last Modified

June 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-58375 →

📋 Description

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate Snowflake report identifiers and export the full contents of any report, including the data returned by the report configured SQL queries and any credentials embedded in its data sources.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-58375
https://github.com/jeecgboot/jimureport/issues/4694
https://www.vulncheck.com/advisories/jimureport-unauthenticated-report-export-via-jmreport-auto-export
https://github.com/advisories/GHSA-cg8w-ggx5-v8p7