CVE-2026-65316 is an authorization bypass vulnerability in XXL-Job version 2.4.2. Authenticated users can exploit an insecure direct object reference flaw by manipulating the logId parameter in the logDetailCat endpoint to access execution logs from unauthorized job groups. This bypasses the permission checks that are enforced on the logDetailPage endpoint, allowing attackers to enumerate and retrieve sensitive log data across all job groups. The vulnerability is due to insufficient access control validation on the logDetailCat endpoint.

An authenticated user with limited permissions can access execution logs from job groups they should not have access to, potentially exposing sensitive operational information. This unauthorized access could lead to information disclosure within the affected environment. There is no indication of privilege escalation, denial of service, or remote unauthenticated exploitation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the logDetailCat endpoint to authorized users only and monitor for unusual access patterns. Avoid exposing the logDetailCat endpoint to untrusted users. Follow vendor updates for any forthcoming patches or official mitigations.