EUVD-2026-96566
GHSA-rj33-fgfv-v3fp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any low-privileged account
-
ExploitEnumerate roleId and permissionId values
-
ExecutionSend GET /sys/role/datarule/{permissionId}/{roleId}
-
ImpactHarvest other roles' data-rule definitions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on JeecgBoot - any low-privileged user account suffices (PR:L); no administrative role, no special feature toggle, and no non-default configuration are needed because the loadDatarule handler in SysRoleController simply omits an authorization check on GET /sys/role/datarule/{permissionId}/{roleId}. The attacker must know or brute-force/enumerate valid permissionId and roleId values. Limiting factors: exploitation is impossible without a login (so it is not remote-unauthenticated), impact is confined to disclosure of role data-rule metadata (no write or RCE), and only instances up to and including version 3.9.5 are affected. |
| Impact | This is a genuine but modest-priority vulnerability - an information-disclosure (CWE-862 Missing Authorization) issue rather than a critical RCE. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: network-reachable, low attack complexity, low privileges required (any authenticated user), no user interaction, and only Low confidentiality impact (VC:L) with no integrity or availability impact. The signals point to a real but bounded risk: publicly available exploit code (POC) raises the practical likelihood of opportunistic use by already-authenticated insiders or attackers who have obtained a low-privileged foothold, but the PR:L requirement meaningfully caps blast radius - this is not remote-unauthenticated. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active in-the-wild exploitation; POC availability must not be conflated with active exploitation. Net: treat as a priority to patch for internet-exposed JeecgBoot instances with many low-trust user accounts, but it is a high-signal-for-its-class disclosure flaw, not a widespread-exploitation emergency. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has phished/obtained any valid account) iterates over role and permission identifiers and issues GET /sys/role/datarule/{permissionId}/{roleId} requests, harvesting the data-rule names, columns, conditions, values, and bound rule ids of privileged roles they should not see. A public POC (poc_dept_role_policy_reads_and_save.py) already demonstrates the request, and with AV:N/AC:L the request is trivial to automate against any reachable instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user read role data-rule metadata - rule names, columns, conditions, values and bound rule IDs - for arbitrary roles via GET /sys/role/datarule/{permissionId}/{roleId}. The loadDatarule handler in SysRoleController omits the authorization check that its sibling endpoints enforce, so a low-privileged account (PR:L, unauthenticated access does not work) can enumerate permissionId/roleId pairs and exfiltrate the row-level access-control policy of the whole tenant. Impact is information disclosure only (CWE-862, no write, no code execution); publicly available exploit code exists, and the CVE is not in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must be compensating rather than upgrade-based until JeecgBoot publishes a release above 3.9.5 - track the project repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-role-datarule-endpoint) for a fix, and when it ships upgrade every instance including the jeecg-system-biz module. Immediately, add the missing authorization check that the handler omits - annotate SysRoleController.loadDatarule with the platform's permission annotation (e.g. @RequiresPermissions/@PreAuthorize) and verify the caller owns or administers the requested roleId rather than trusting the path parameter - then redeploy with the patched class; this is the only control that fully removes the flaw but requires a code change and regression testing of the role-permission configuration screen. As a no-code stopgap, block or restrict GET /sys/role/datarule/** at the reverse proxy or via Spring Security path rules so that only administrative roles can reach it; the trade-off is that legitimate non-admin role/rule lookups and any UI that renders data-rule summaries will break, so scope the rule to non-admin principals and log denials. Reduce the attack surface by auditing and disabling unnecessary low-privileged account provisioning and by adding the endpoint to authenticated-request monitoring, since exploitation requires enumerating valid permissionId/roleId pairs and generates a distinctive, high-volume access pattern on that path. Finally, treat exposed data-rule definitions as potentially compromised schema and policy metadata and review any filtering or tenant-isolation logic they reveal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot / Java low-code development platform whose jeecg-system-biz module exposes REST controllers for administration. Data rules (datarules) are the platform's row-level permission mechanism: each rule bound to a role defines a column, an operator/condition and a value that filters the rows a user of that role may see. The vulnerable handler is SysRoleController.loadDatarule (jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysRoleController.java, roughly lines 449-473), mapped to GET /sys/role/datarule/{permissionId}/{roleId}. Per the CWE-862 (Missing Authorization) classification, the endpoint performs no permission or role-ownership check before querying the data-rule records, unlike surrounding administrator endpoints in the same controller. Because the response is driven purely by path parameters rather than by the caller's identity, the authorization model collapses to 'any valid session'. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms the whole product line up to and including the fixed-version boundary; 3.9.5 is the last affected release per the description. The technical exposure is metadata rather than data-plane records, but data-rule definitions reveal the schema, column names and comparison values used for tenant isolation, which materially aids a follow-up data-extraction or privilege-escalation attempt.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable REST endpoint with low complexity but requires a low-privileged authenticated account (PR:L); only data-rule metadata is disclosed, so C:L and I/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB