EUVD-2026-40364
GHSA-6w4x-5vf2-7756
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoints with low complexity and only a low-privilege account (PR:L); plaintext secret disclosure gives C:H and credential CRUD gives I:H, with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
AnalysisAI
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController and OpenApiPermissionController endpoints, which are missing Shiro authorization annotations, to fully manage OpenAPI AK/SK credentials. Because the list endpoint returns secret keys in plaintext, any logged-in user can harvest every Access Key/Secret Key pair and then create, modify, or delete them, enabling credential theft and unauthorized invocation of the OpenAPI surface. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
Technical ContextAI
JeecgBoot is an open-source Java low-code development platform that uses Apache Shiro for authentication and authorization, typically enforced via annotations (e.g. @RequiresPermissions/@RequiresRoles) on controller methods. The root cause is CWE-862 (Missing Authorization): the OpenApiAuthController and OpenApiPermissionController endpoints that govern OpenAPI credential management omit those Shiro authorization annotations, so the framework authenticates the session but never checks whether the caller is entitled to the OpenAPI credential functions. The OpenAPI mechanism relies on AK/SK (Access Key/Secret Key) pairs for machine-to-machine API authentication; exposing the secret key in plaintext through an unauthorized list endpoint collapses that trust model. The single CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* covers all versions up to and including 3.9.2.
RemediationAI
No vendor-released patch version was identified at time of analysis - the only references are the JeecgBoot GitHub issue (https://github.com/jeecgboot/JeecgBoot/issues/9705) and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-missing-authorization-on-openapi-credential-management-endpoints-exposes-access-secret-keys); monitor both for a fixed release and upgrade as soon as one is published. As a compensating control, add the missing Shiro authorization annotations (or an equivalent permission interceptor) to the OpenApiAuthController and OpenApiPermissionController methods so the credential endpoints require an OpenAPI-admin permission, which is the precise root-cause fix but requires building from source. Where code changes are not feasible, restrict access to the OpenAPI credential management routes at a reverse proxy or gateway (allowlist only administrator IPs/roles), with the trade-off that legitimate non-allowlisted admins lose access; also rotate all existing AK/SK pairs after locking down the endpoints since secrets may already have been exposed in plaintext, accepting that rotation will break any integrations using the old keys until they are re-provisioned.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
Server-side request forgery (SSRF) in JeecgBoot's AI RAG chat endpoint (/airag/chat/send) exposes unauthenticated remote
Improper access control in JeecgBoot through version 3.9.1 exposes the LoginController.selectDepart endpoint at /sys/sel
Unauthenticated access to JimuReport's report folder template listing endpoint exposes all report definitions, share tok
Missing authentication in JeecgBoot 3.9.0 and 3.9.1 allows unauthenticated remote attackers to access the AI Chat Module
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipu
Improper authentication in JeecgBoot 3.9.1 OpenAPI endpoint allows remote attackers to bypass authentication checks and
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user
Improper access control in JeecgBoot versions up to 3.9.1 allows authenticated low-privileged remote attackers to bypass
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today