This vulnerability exists in XXL‑JOB 3.5.0‑SNAPSHOT and all earlier releases. This is a Cross‑Site Request Forgery (CWE‑352) vulnerability, where the user management controller endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and accept requests without any HTTP method restriction. An attacker who can trick an authenticated user into visiting a crafted URL or embedding a request in a trusted domain can cause that user to create new users, modify existing users, or delete users. The result is the ability to introduce privileged accounts, alter user roles, or remove administrators, effectively granting an attacker administrative control over the job platform.

XXL‑JOB version 3.5.0‑SNAPSHOT and earlier are affected. No other product or vendor information is available in the advisory. The vulnerability resides in the JobUserController within the XXL‑JOB application.

The vulnerability is rated CVSS 8.8, indicating high severity. The EPSS score is less than 1%, implying it is not widely exploited yet. It is not listed in the CISA KEV catalog. The likely attack vector is a browser‑based CSRF attack that relies on the victim being authenticated against the target system. Because CSRF mitigation is absent, the attack is straightforward for anyone capable of delivering a malicious request.