EUVD-2026-96613
GHSA-gp24-2q47-7684
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliveryRequest GET /openapi/queryById with entry id
-
ExploitBypass missing openapi permission check
-
ExecutionRead internal URLs, IP whitelists, header templates
-
ImpactLeverage data to reach internal gateway endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on the JeecgBoot instance (PR:L) - it is NOT remote-unauthenticated. The attacker must be able to reach the /openapi/queryById endpoint over the network and supply a valid OpenAPI entry id. No special non-default configuration or user interaction is needed; the flaw is a missing authorization check in the queryById handler, so any authenticated user lacking the openapi permission can read OpenAPI definition metadata. The limiting factor is the authentication requirement and the fact that impact is confined to disclosure of configuration metadata rather than direct code execution or data modification. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L), and impact is limited to confidentiality of configuration metadata (VC:L, with VI:N/VA:N) - so the 5.3 Medium score is well-calibrated rather than inflated. Public exploit code exists (reported by VulnCheck with a GitHub PoC), which raises practical exploitability, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation at this time. The signals are internally consistent: a low-privilege authorization bypass (CWE-862) with a working PoC but no confirmed in-the-wild activity. The main caveat is that the exposed data (internal origin URLs, virtual paths, IP whitelists, header/parameter templates) is primarily useful as reconnaissance to enable follow-on attacks against the OpenAPI gateway, so real-world risk depends heavily on what those internal endpoints protect. |
| Exploit ScenarioDerived | A low-privileged authenticated JeecgBoot user - or an attacker who has obtained any valid low-tier credential - sends GET /openapi/queryById with an entry id to the OpenApiController, despite lacking the openapi permission. The response leaks internal origin URLs, virtual paths, IP whitelist entries, and header/parameter templates, which the attacker uses to map and then invoke internal gateway endpoints. A public PoC (poc_openapi_config_and_call_gateway.py) demonstrating exactly this config-disclosure-then-gateway-call flow is already available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to read OpenAPI gateway definitions they are not entitled to see, exposing internal origin URLs, virtual paths, IP whitelists, and header and parameter templates. The flaw (CWE-862) lives in the OpenApiController queryById handler, which fails to enforce the openapi permission, so a simple GET /openapi/queryById with a valid entry id returns configuration metadata. It is a moderate-severity issue (CVSS 5.3, PR:L, confidentiality-only impact) for which publicly available exploit code exists, but there is no indication of confirmed active exploitation and the CVE is not in CISA KEV.
RemediationAI
Patch status: no vendor-released patch version is identified in the available data, so organizations should track the JeecgBoot project and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-openapi-querybyid) and upgrade to the first release after 3.9.5 that fixes the missing check. Where upgrading is not immediately possible, add the missing authorization enforcement at the application level by guarding OpenApiController.queryById with the same openapi permission annotation used by the other OpenAPI endpoints, or by adding a Spring Security/filter interceptor rule that requires the openapi authority for GET /openapi/queryById; the trade-off is that this is a custom code change that must be re-applied after each upgrade. As a shorter-term compensating control, restrict network access to /openapi/queryById at the reverse proxy or WAF so only trusted administrative networks can reach it, and disable or unmount the OpenAPI gateway module entirely if it is unused - noting that blocking the endpoint will break legitimate OpenAPI management UIs for all users, including administrators. Because the flaw can leak internal origin URLs, virtual paths, IP whitelists and header/parameter templates to any authenticated user, audit OpenAPI entries for embedded credentials or secrets and rotate anything exposed, tighten IP whitelists on the upstream services, and enable logging/alerting on /openapi/queryById requests to detect the publicly available exploit. The public PoC substantially lowers the barrier to abuse, so remediation should be prioritized above cosmetic issues even though the assessed impact is limited to information disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform whose OpenAPI module acts as an outbound API gateway, storing per-entry configuration such as the internal origin/origin-URL of the upstream service, the externally exposed virtual path, IP whitelists, and templated request headers and parameters. CWE-862 (Missing Authorization) is the root-cause class here: the queryById handler in OpenApiController (see the referenced source at lines ~150-154) performs the lookup and returns the definition without applying the authorization/permission check that guards other OpenAPI operations, so the security decision is simply absent rather than bypassable. The affected-component CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* is a wildcard, indicating that the data provided does not enumerate a fixed version, consistent with the description covering everything through 3.9.5. Because the disclosed fields describe internal routing and trust configuration, the data is reconnaissance-grade material that could support follow-on attacks against the proxied backends rather than direct code execution or modification.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N/AC:L) requiring a low-privileged authenticated account (PR:L), leaking only configuration metadata, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB