PowerJob list authorization

Vulnerability

Overview

CVE-2025-11580 describes a missing authorization vulnerability in the distributed job scheduling framework PowerJob, affecting versions up to and including 5.1.2. The flaw resides in the UserInfoController.list() method mapped to the /user/list endpoint. The controller method lacks the @ApiPermission annotation and performs no internal authorization checks, allowing any unauthenticated request to access the full list of registered users [1][3].

Exploitation

An attacker can exploit this vulnerability by sending a simple HTTP GET request to /user/list without any authentication tokens or headers. The request does not require any special privileges or network position, as the endpoint is exposed to remote callers. The reference includes a verified proof-of-concept showing that the server returns all user information in JSON format [3].

Impact

A successful attack allows an unauthenticated remote attacker to enumerate all user accounts in the PowerJob instance. This information leakage can be used to identify valid usernames, which may facilitate further targeted attacks such as credential stuffing, phishing, or privilege escalation against those users. The advisory notes that this is a CWE-862 Missing Authorization issue and constitutes a vertical authorization error [3].

Mitigation

As of the advisory date (October 2025), the fix is to add the @ApiPermission annotation to the list method to enforce proper access control. Users are advised to upgrade to a patched version beyond 5.1.2, or apply the code-level remediation if running a custom deployment. The project maintainers were notified via the GitHub issue linked in the advisory [3].