High severity8.8NVD Advisory· Published Oct 15, 2026

CVE-2026-106708

Description

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xxl Job/xxl-job-adminllm-fuzzy
Range: <=3.5.0-SNAPSHOT

Patches

Vulnerability mechanics

References

github.com/tao0845/CVE-Request/blob/main/CVE-2026-106708.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000