JeecgBoot CVE-2026-7604

Q: What is the CVSS score of CVE-2026-7604?

CVE-2026-7604 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26739 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-02 cna@vuldb.com

Java SSRF

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26739

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.

AnalysisAI

Server-side request forgery in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to manipulate the originUrl parameter in OpenApiController.add and OpenApiController.call methods, enabling arbitrary HTTP requests from the affected server. The vulnerability requires low-level authentication privileges and carries minimal direct impact (CVSS 2.1), but public exploit code exists and vendors confirmed the issue with a fix planned for an upcoming release.

Technical ContextAI

JeecgBoot is a Java-based low-code development platform built on the Spring Boot framework. The OpenApi Service component, specifically the OpenApiController.java file, processes user-supplied input via the originUrl parameter without proper validation or sanitization. This parameter is passed to server-side HTTP request mechanisms (likely HttpClient or similar), allowing attackers to specify arbitrary URLs. The vulnerability stems from CWE-918 (Server-Side Request Forgery), where attacker-controlled data influences the target of outbound network requests. The SSRF attack vector enables probing of internal services, triggering actions on behalf of the server, or exfiltrating data from internal networks not directly accessible to external attackers.

RemediationAI

Upgrade JeecgBoot to a patched version released after 3.9.1 that includes fixes for the OpenApi Service SSRF vulnerability; exact fix version not specified in available data, so contact vendor for release timeline. Until patching, implement network-level controls: restrict outbound HTTP/HTTPS from the JeecgBoot application server to only explicitly approved internal and external hosts (whitelist approach using egress firewall rules or network policies), disable or remove the OpenApi feature if not in use, restrict access to OpenApiController endpoints to trusted users only via WAF or application-level access controls (reduce authentication scope from current PR:L if possible), and implement request validation to block unauthorized URL schemes (block file://, gopher://, internal IP ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Each mitigation has trade-offs: network whitelisting may break legitimate integrations if URL destinations are not pre-enumerated; feature disablement impacts users relying on OpenApi functionality; access restrictions reduce feature availability to legitimate users. Prioritize patching once vendor releases the fix.