JeecgBoot CVE-2026-11464

Exploitation requires an authenticated session with at least low-privilege access (PR:L per CVSS vector) to the JeecgBoot application - anonymous or unauthenticated exploitation is not supported by the available CVSS data. The attacker must have network access to the User List Endpoint over HTTP/S (AV:N). High attack complexity (AC:H) constrains exploitation - the specific parameter manipulation conditions or application state prerequisites are not fully enumerated in available data, but the description and POC confirm the salt argument as the manipulable vector. No user interaction is required (UI:N). Exploitation is limited by: the authenticated access prerequisite, high complexity, scope being unchanged (S:U - no lateral movement at the vulnerability layer), and the fact that only salt values - not password hashes or credentials directly - are disclosed.

The CVSS 3.1 base score of 3.1 (Low) reflects high attack complexity (AC:H), a low-privilege authentication requirement (PR:L), and a limited confidentiality impact (C:L) with no integrity or availability impact. The network attack vector (AV:N) means the endpoint is reachable remotely, but AC:H implies exploitation is not straightforward - likely requiring specific parameter knowledge or application state conditions not fully detailed in available data. The temporal modifier E:P (Proof-of-Concept) confirms a public POC exists, which meaningfully elevates practical risk above the raw base score. No EPSS score data was provided, so probability-of-exploitation quantification is unavailable. KEV status is not listed - active exploitation is not confirmed by CISA. The primary real-world concern is not direct system compromise but credential reconnaissance: exposed salts combined with a separately obtained password hash could enable offline cracking. This is a moderate-priority finding for environments where JeecgBoot user accounts have elevated downstream access, and higher-priority if the application manages privileged identities.

An attacker with a valid low-privilege JeecgBoot account sends a crafted HTTP request to the /sys/user/queryPageList endpoint, manipulating the salt parameter to trigger disclosure of per-user salt values in the API response. A public proof-of-concept is available via GitHub issue #9648, reducing the technical barrier despite the noted high attack complexity. With harvested salts and separately obtained password hashes (via another vulnerability or database exposure), the attacker could conduct targeted offline dictionary attacks against user credentials.