JeecgBoot CVE-2026-108891

Exploitation requires the attacker to already hold a valid authenticated JeecgBoot account (PR:L); any low-privileged user suffices, with no admin rights, user interaction, or special configuration needed, and it works against the standard SysUserController getUserDetailByUserId endpoint. The limiting factor is therefore account access: the flaw is only reachable post-authentication, so deployments that tightly restrict account provisioning or network exposure of the admin/API surface meaningfully reduce real-world risk, while instances allowing self-registration or many low-trust users are far more exposed.

This is a genuine but moderate-priority information-disclosure flaw, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, with impact limited to confidentiality of the vulnerable system (VC:L, VI:N, VA:N) - consistent with CWE-862 missing authorization enabling horizontal IDOR-style access to other users' PII. Publicly available exploit code exists (a Python POC in the referenced GitHub repo), which raises practical exploitability, but the issue is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (low-privilege, network, low confidentiality impact) and point to a realistic post-authentication data-harvesting risk in multi-tenant or large-user JeecgBoot deployments, rather than a mass-exploitation emergency; its real-world weight depends heavily on how freely low-privileged accounts can be obtained in a given deployment.

An attacker who holds any valid low-privileged JeecgBoot account authenticates and issues requests to the SysUserController getUserDetailByUserId endpoint, iterating arbitrary userId values. Because the handler performs no authorization check, the attacker enumerates and harvests other users' real names, usernames, emails, phone numbers, birthdays, employee numbers, and department/post data. A public Python POC (poc_sys_user_detail_by_user_id.py) automates this enumeration.