JeecgBoot CVE-2026-108866

Requires a valid authenticated session on the target JeecgBoot instance at any privilege level (PR:L) - the attacker must already possess or register a low-privileged account before invoking the vulnerable sys/api queryUserAuths endpoint with an attacker-chosen userId. No user interaction or non-default configuration is needed, and the endpoint is network-reachable, but the authentication requirement is the primary limiting factor: instances without self-registration or with no attacker-held credentials are not exploitable by fully external parties. Impact is bounded to disclosure of other users' permission data (VC:L); no data modification or service disruption results.

This is a genuine but moderate-severity issue, correctly rated rather than inflated. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring low privileges (PR:L) with only limited confidentiality impact and no integrity or availability impact - fully consistent with the description of an authenticated information-disclosure/IDOR flaw. A public POC exists (publicly available exploit code exists), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation - treat POC availability and active exploitation as distinct signals. The required PR:L (any authenticated low-privileged account) meaningfully limits mass exploitation, since an attacker must first obtain valid credentials to the JeecgBoot instance. The realistic risk is as a reconnaissance/privilege-escalation enabler: it leaks another account's complete permission set and reveals which accounts are administrators, which is valuable as a precursor to a targeted follow-on attack rather than as a direct compromise. No signals conflict; the main gaps are the absent EPSS score and the lack of an independently verified fixed version.

An attacker who already holds any low-privileged JeecgBoot account authenticates and calls the queryUserAuths handler, passing a userId belonging to another user. The server returns that user's full permission set, letting the attacker enumerate accounts and pinpoint administrators to target next. A public Python POC (poc_sys_api_query_user_auths.py) demonstrates the request, and the low attack complexity (AC:L) means the request succeeds reliably against affected versions.