EUVD-2026-96617
GHSA-crh3-f6w4-mf88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSend GET to /sys/api/queryUserRoles with target username
-
ExecutionReceive unauthorized role codes
-
ImpactIdentify administrator accounts for targeted follow-on attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated JeecgBoot account of any privilege level (CVSS PR:L); the attacker then abuses the queryUserRoles handler in SystemApiController, which is missing an authorization check, by issuing GET requests to /sys/api/queryUserRoles with an arbitrary username parameter. No special feature flag or non-default configuration is needed - the endpoint is exploitable in default deployments - but the authentication requirement (and the need for the target username, though these are enumerable) is the primary limiting factor, and impact is confined to disclosure of role codes. |
| Impact | This is a genuine but modest-severity information-disclosure issue, not a high-priority crisis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree with the description: a network-reachable endpoint, low attack complexity, but requiring an already-authenticated low-privileged account (PR:L) and causing only limited confidentiality impact (VC:L) with no integrity or availability effect. Publicly available POC code exists (confirmed via the GitHub exploit reference), which lowers the practical barrier to abuse, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of active, widespread exploitation - this is best treated as an enumeration/recon aid rather than a standalone breach vector. The realistic value to an attacker is reconnaissance: enumerating which accounts hold administrator roles to focus follow-on attacks (credential stuffing, phishing, or chaining with other JeecgBoot flaws). No signals conflict here; the main caveat is the absence of EPSS data, so probability-of-exploitation cannot be quantified. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged JeecgBoot account (e.g., a self-registered or compromised ordinary user) sends GET requests to /sys/api/queryUserRoles supplying arbitrary usernames. Because the handler performs no authorization check, it returns each target's role codes, letting the attacker map out which accounts are administrators. Public POC code (poc_sys_api_credential_family.py) automates this enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated low-privileged user read arbitrary users' role codes by sending GET requests to /sys/api/queryUserRoles with an arbitrary username parameter, allowing role-assignment discovery and identification of administrator accounts. The issue is tracked as CWE-862 (missing authorization) with an assessed CVSS of 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:N/A:N), requiring only a valid JeecgBoot account of any privilege level; impact is confined to information disclosure rather than write or execution capability. Publicly available exploit code exists for this endpoint, but there is no indication of confirmed active exploitation (CISA KEV); the endpoint is exploitable in default deployments with no special configuration, making the authentication requirement the primary limiting factor.
RemediationAI
No vendor-released patch version is identified in the available intelligence at time of analysis, so remediation should combine access control hardening on the affected endpoint with monitoring until an official fix is published; track the VulnCheck advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-queryuserroles and the upstream JeecgBoot repository for a patched release above 3.9.5. Compensating controls that reduce exposure without breaking legitimate use: enforce role-based authorization on /sys/api/queryUserRoles at the application layer so only administrators can invoke it, or if the endpoint is not needed, disable it entirely via a Spring Security filter or controller-level mapping removal - the trade-off is that any dependent internal integrations calling that path will fail and must be migrated to an authorized alternative. As a network-layer mitigation, block or restrict /sys/api/queryUserRoles at a reverse proxy, API gateway, or WAF to trusted administrative source addresses or internal service accounts only; this can be bypassed if an attacker gains a foothold inside the trusted network segment, so it should not be the sole control. Additionally, reduce the blast radius of username enumeration by validating and rate-limiting the username parameter, auditing role assignments for unexpected administrators, and logging GET requests to /sys/api/queryUserRoles with unusual or repeated username values to detect reconnaissance activity; note that logging alone does not prevent disclosure and must be paired with the authorization or blocking controls above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring-Boot low-code development platform; its jeecg-module-system component exposes system APIs through SystemApiController. In the affected code path around lines 472-475 of SystemApiController.java, the queryUserRoles handler accepts a username parameter and returns the associated role codes without performing an authorization check on the caller, a classic CWE-862 missing authorization flaw. Because the endpoint is registered under /sys/api and reachable by any authenticated session, users with the lowest privileges can supply arbitrary usernames - which are typically enumerable - to map role assignments and flag accounts holding administrative roles. The flaw does not grant privilege escalation, code execution, or data modification on its own; its value to an attacker is in reconnaissance and targeting. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* indicates all versions through the stated ceiling (3.9.5) are in scope, and the referenced GitHub source lines and VulnCheck advisory corroborate the vulnerable handler.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network API reachable with low complexity, but a low-privileged authenticated account is required (PR:L); only role-code confidentiality is exposed (C:L), with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB