XXL-Job version 2.4.2 suffers from an insecure direct object reference that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the /joblog/logDetailCat endpoint. Because the endpoint does not perform an authorization check, an attacker can enumerate log records across all job groups and retrieve sensitive log content. The vulnerability is classified as CWE‑639, indicating a missing authorization check. Based on the description, interface to exploit the flaw.

The affected product is Xuxueli’s XXL-Job version 2.4.2. No other vendors or products are listed as affected. The vulnerability pertains to the /joblog/logDetailCat API endpoint used for fetching job execution logs.

The CVSS score of 7.1 places the vulnerability in the Medium‑to‑High severity range, and the EPSS score of < 1 % indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface: an attacker who already has valid login credentials can send HTTP requests to /joblog/logDetailCat with an incremented logId parameter to enumerate and retrieve logs from unauthorized job groups. Because the exploit does not involve executing code or modifying the application, it can be automated with a simple script, though it still requires authenticated access.