An authentication bypass vulnerability in JimuReport allows unauthenticated attackers to enumerate reports and retrieve sensitive share tokens, posing a high risk to information security.

This vulnerability (CWE-306) stems from a missing authentication check on the report folder template listing endpoint, which permits unauthenticated users to interact with critical reporting functions.

The ability to enumerate reports and steal share tokens can lead to unauthorized access to sensitive business intelligence data. With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality, potentially exposing proprietary reports to unauthorized parties.

Immediate Action: Check for available updates from the vendor and apply them immediately; if no patch is available, restrict access to the affected endpoint via network-level controls.

Proactive Monitoring: Audit application access logs for unauthorized access attempts directed at the report folder listing endpoint.

Compensating Controls: Use a Web Application Firewall to restrict access to the reporting interface, ensuring only authorized IP addresses or authenticated sessions can reach the vulnerable endpoint.

Public Exploit Available: No (no confirmed public exploit or weaponized code in the available data).

Organizations should immediately investigate their JimuReport deployment and implement access restrictions to the report listing functionality. Until a vendor patch is confirmed and applied, limiting network exposure is the most effective way to mitigate the risk of unauthorized data disclosure.