Is there a public PoC exploit available for CVE-2025-14909?

Yes, a public proof-of-concept exploit is available for CVE-2025-14909. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2025-14909?

Yes, a patch is available for CVE-2025-14909. Update the affected software to the latest version immediately.

JeecgBoot CVE-2025-14909

Q: What is the CVSS score of CVE-2025-14909?

CVE-2025-14909 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Manage User Sessions (CWE-1018)

2025-12-19 cna@vuldb.com

Information Disclosure Java Jeecg Boot

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:49 vuln.today

DescriptionCVE.org

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.

AnalysisAI

JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.

Technical ContextAI

JeecgBoot is a low-code enterprise application development platform built on Java/Spring. The vulnerability resides in the SysUserOnlineController class (jeecg-boot/jeecg-module-system/jeecg-system-biz), which handles user session management and online user tracking. CWE-1018 (Improper Restriction of Rendered UI Layers or Frames) suggests the weakness involves inadequate access controls or authorization checks on session manipulation endpoints exposed via this controller. The affected element is explicitly named as the function within SysUserOnlineController, indicating a specific method lacks proper authentication or authorization validation for operations that affect user session state. This is a common issue in low-code platforms where auto-generated or templated controllers may inherit overly permissive defaults.

RemediationAI

Apply the vendor-released patch by updating to a JeecgBoot version containing commit b686f9fbd1917edffe5922c6362c817a9361cfbd or later. This commit directly addresses the SysUserOnlineController authorization weakness. Users unable to immediately patch should implement compensating controls: restrict network access to the SysUserOnlineController endpoints to trusted internal networks only via firewall rules or reverse proxy ACLs, disable or hide user session management features if not actively used in the application, enforce role-based access control (RBAC) at the application level to ensure only administrative users can invoke SysUserOnlineController methods, and monitor session-related logs for suspicious manipulation attempts. The trade-off of these controls is operational complexity and potential usability impact if legitimate administrators rely on remote session management; patching is the preferred long-term solution. Patch status and release notes are available at the GitHub commit reference and issue tracker linked in the advisory.