JeecgBoot CVE-2026-108886

The attacker must possess a valid authenticated JeecgBoot account of any privilege level (CVSS PR:L); it is not exploitable by fully unauthenticated attackers. Given such an account, no special configuration is required - the SysUserController queryChildrenByUsername handler in versions through 3.9.5 performs no authorization check, so the attacker simply supplies arbitrary userId parameter values to retrieve other users' records. The primary limiting factors are the need for a valid session and that impact is confined to confidentiality of user-profile and department data (names, emails, phone numbers, employee numbers, department/staff assignments); no write or availability impact is possible.

This is a moderate, not critical, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (medium) and is internally consistent with the description: network-reachable, low attack complexity, requires an already-authenticated low-privileged account (PR:L), no user interaction, and only low confidentiality impact with zero integrity or availability impact. A public POC exists (reported by VulnCheck), which raises operational risk because exploitation is trivial once an attacker has any valid account, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - treat this as a confirmed, easily-reproducible information-disclosure flaw rather than an urgent in-the-wild threat. The dominant limiting factor is the PR:L requirement: the attacker must first obtain a legitimate (even if low-privilege) account, which bounds blast radius to insiders or attackers who have already gained a foothold. No signals conflict; the main gap is the absence of EPSS/KEV data, so exploitation-probability cannot be quantified beyond the fact that working exploit code is public.

An attacker who holds any valid low-privileged JeecgBoot account authenticates to the application and invokes the SysUserController queryChildrenByUsername endpoint, substituting arbitrary userId values they were never authorized to view. Because the handler performs no authorization check, the server returns other users' names, emails, phone numbers, employee numbers, and department/staff relationships, enabling harvesting of organizational PII for phishing or further intrusion. A public Python POC for this exact endpoint is available, making reproduction straightforward.