{"affected":[{"defaultStatus":"unaffected","product":"AJ-Report","source":"CNA: VulnCheck","vendor":"anji-plus","versions":[{"lessThanOrEqual":"1.7.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120209","cwes":["CWE-321"],"description":"AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.","epss":{"date":"2026-11-02","percentile":0.45658,"score":0.00544},"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":9.8,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793630275775,"publishedAt":1793467556161,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://gitee.com/belief-team/report/issues/IKRV6T"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://gitee.com/belief-team/report"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token"}],"remediation":[],"revision":"721f6e5e39e780931bd6a5712c8a3c4a60c9e82c029967f50893cdec6c0456db","sources":[{"modifiedAt":1793630275775,"name":"CNA: VulnCheck","retrievedAt":1793632112742,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120209"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793632117920,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-120209"}],"ssvc":{"assessedAt":1793630262918,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token","updatedAt":1793632117920}