Is there a public PoC exploit available for CVE-2025-15126?

Yes, a public proof-of-concept exploit is available for CVE-2025-15126. Prioritise patching immediately. EPSS: 0.0%.

JeecgBoot CVE-2025-15126

Q: What is the CVSS score of CVE-2025-15126?

CVE-2025-15126 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Incorrect Privilege Assignment (CWE-266)

2025-12-28 cna@vuldb.com

Information Disclosure Jeecg Boot

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Requires authenticated low-privilege session and high complexity; confidentiality-only impact via user enumeration; no integrity or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:10 vuln.today

CVE Published

Dec 28, 2025 - 08:15 cve.org

LOW 1.3

DescriptionCVE.org

A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in JeecgBoot's position management API allows authenticated low-privilege users to enumerate personnel assigned to arbitrary organizational positions by manipulating the positionId parameter at the /sys/position/getPositionUserList endpoint. All versions up to and including 3.9.0 are confirmed affected per NVD CPE data. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and EPSS of 0.04% (11th percentile) indicate this is a limited-impact, difficult-to-exploit information disclosure - no active exploitation has been confirmed.

Technical ContextAI

JeecgBoot (CPE: cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*) is a Java-based low-code enterprise rapid development platform widely used in Chinese enterprise and government deployments. The affected component is the position management module, specifically the REST endpoint /sys/position/getPositionUserList, which retrieves a list of users associated with a given organizational position. The root cause is classified as CWE-266 (Incorrect Privilege Assignment): the server-side function does not adequately validate whether the authenticated caller holds the necessary privileges to view the user list for the requested positionId value. This is functionally an Insecure Direct Object Reference (IDOR) pattern, where a sequentially guessable or enumerable identifier is accepted without proper ownership or authorization checks, allowing lateral access to organizational hierarchy data outside the caller's authorized scope.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. As a compensating control, operators should implement server-side authorization enforcement at the application or API gateway layer to validate that the requesting user's session principal is permitted to query the specific positionId value before returning results. Restricting access to the /sys/position/getPositionUserList endpoint to roles that legitimately require it (e.g., HR administrators) via role-based access control configuration reduces the exposed attack surface. Network-level controls restricting access to the JeecgBoot management interface to trusted internal networks will limit the network-accessible attack vector. Organizations should monitor VulDB entry 338504 and the official JeecgBoot repository for a future patch release. The PoC is publicly documented at https://github.com/Hwwg/cve/issues/39 and https://vuldb.com/?id.338504.