EUVD-2026-96592
GHSA-68w6-2grj-8rwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any low-privileged JeecgBoot account
-
DeliverySend GET /openapi/list
-
ExploitMissing authorization returns registry
-
ExecutionHarvest internal URLs and IP whitelists
-
ImpactPivot against internal gateway backends
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot session for any low-privileged user (CVSS PR:L); no admin role, user interaction, or non-default configuration is needed because the queryPageList handler in OpenApiController lacks an authorization check on GET /openapi/list. Limiting factors: the attacker must first possess or obtain credentials (self-registration or stolen/leaked account), and the OpenAPI module/endpoint must be deployed and reachable; impact is read-only disclosure of OpenAPI registry definitions (virtual paths, internal origin URLs, IP whitelists, header/parameter templates) with no direct write or availability effect. |
| Impact | This is a genuine but modest-severity information-disclosure issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: exploitation is network-reachable and low-complexity but requires an existing authenticated low-privileged account (PR:L), and impact is confined to confidentiality (VC:L, with VI:N/VA:N). The real-world driver is that a working POC is publicly available (published alongside a VulnCheck advisory), which materially raises the odds of opportunistic use against exposed instances. However, there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - the signals point to a credential-gated reconnaissance primitive rather than a direct system takeover. The disclosed data (internal origin URLs, IP whitelists, header/parameter templates, virtual paths) is valuable as a stepping stone to attack the OpenAPI gateway or internal services, so the practical risk is as an enabler within a chain rather than as a standalone critical flaw. EPSS data is missing and should be checked to refine prioritization. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privileged JeecgBoot account (self-registered or compromised) sends GET /openapi/list and receives the full OpenAPI registry, including internal origin URLs, IP whitelists, and admin-oriented header/parameter templates. A public POC (poc_openapi_config_and_call_gateway.py) demonstrates reading these definitions and exercising the gateway, so the attacker can use the leaked configuration to map and target internal backends. Because the CVSS vector is PR:L, this requires authentication but no special privilege or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
JeecgBoot through 3.9.5 exposes an authorization gap in the OpenApiController.queryPageList handler, letting any authenticated user - including a low-privileged one - retrieve the OpenAPI registry listing via GET /openapi/list and read virtual paths, internal origin URLs, IP whitelists, and header/parameter templates meant for administrators. Exploitation requires only a valid, non-admin JeecgBoot session (CVSS PR:L) and publicly available exploit code exists, though no active exploitation has been confirmed via CISA KEV; the CVSS 3.1 assessment scores it 5.3 as a read-only confidentiality disclosure with no integrity or availability impact, and EPSS data was not provided. The practical risk is moderate: the leak itself does not grant code execution, but it hands an attacker the internal routing and gateway configuration needed to plan follow-on attacks against otherwise hidden backend services.
RemediationAI
No vendor-released patch was identified at time of analysis: the only code reference supplied (https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java#L73-L80) points at the vulnerable handler rather than a fix commit, and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-get-openapi-list) does not publish a patched version, so check upstream release notes for 3.9.6-and-later builds and monitor the advisory for an update. The most direct mitigation is to add an explicit authorization check to queryPageList - a role or permission annotation such as @RequiresPermissions/@PreAuthorize requiring an administrator authority, or a programmatic check in the method body - which is a small, self-contained source change but must be re-applied after each upstream upgrade until an official fix lands. If code changes are not immediately possible and the OpenAPI gateway is not in active use, disable or undeploy the module entirely; the trade-off is losing the OpenAPI registry/proxy functionality. Otherwise, restrict the path /openapi/list (and the /openapi/** prefix) at the reverse proxy or API gateway so only trusted administrative source addresses or admin-authenticated sessions can reach it, accepting that this depends on the edge layer remaining correctly configured and may break legitimate admin tooling. Because exploitation requires a valid account, pair these controls with credential hygiene: audit and disable unused or self-registered low-privileged accounts, enforce strong admin credentials, and rotate any credentials that may have been leaked, since the disclosed IP whitelists and origin URLs degrade the value of network-based trust assumptions. Finally, review JeecgBoot access logs for GET /openapi/list requests from non-administrative users to detect reconnaissance; note that this endpoint is read-only, so detection must focus on the request itself rather than any write-side symptom.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot-based low-code development platform whose system module ships an OpenAPI gateway component; the affected class is org.jeecg.modules.openapi.controller.OpenApiController, where the queryPageList method (referenced lines 73-80 in the upstream repository) is mapped to GET /openapi/list. The root cause is CWE-862 (Missing Authorization): the handler performs data retrieval without any permission or role check, so Spring Security's authentication layer is satisfied by any valid session while the authorization layer never runs. The endpoint paginates and returns OpenAPI registry records, which in JeecgBoot include the externally published virtual path, the internal upstream/origin URL, configured IP whitelists, and the header and parameter templates applied to proxied calls - effectively a map of the gateway's internal topology and its access-control intent. Because the disclosure is read-only (VC:L, VI:N, VA:N) and scoped to the vulnerable component (S:U), the CVSS 4.0 vector and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree on limited-severity information exposure once an attacker holds any authenticated account. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is version-agnostic, indicating the exposure is reported across the product line up to 3.9.5 rather than tied to one release.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable, low-complexity endpoint requiring an authenticated low-privileged account (PR:L); only configuration metadata is disclosed, so C:L with I:N/A:N and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB