Is CVE-2026-106708 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-106708?

CVE-2026-106708 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-106708

Description

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.