JeecgBoot CVE-2026-9579

A valid low-privileged authenticated account on the target JeecgBoot instance is required, as confirmed by the CVSS vector PR:L. The attack is network-delivered (AV:N) and requires no user interaction (UI:N), meaning exploitation is fully remote once credentials are in hand. The vulnerable code path is within the user profile settings feature - specifically the userIdentity parameter passed to user.getUsername in the SysUser component at /sys/user/login/setting/userEdit. Exploitation is constrained to JeecgBoot deployments running version 3.9.1 or earlier where the user settings module is accessible. Exploitation is further limited by the necessity of a valid account; entirely unauthenticated exploitation is not supported by the available CVSS data. Non-default configurations or special feature flags are not identified as prerequisites - any standard JeecgBoot deployment up to 3.9.1 with its default user management functionality enabled is potentially affected.

The CVSS base score of 6.3 (Medium) reflects a network-reachable, low-complexity attack requiring low-level authentication (PR:L) with no user interaction, yielding limited but real impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The PR:L requirement is the primary risk limiter - an attacker must possess at least one valid low-privileged account, which meaningfully restricts exploitation compared to unauthenticated flaws. However, the E:P temporal metric confirms POC code is publicly available via GitHub, lowering attacker skill requirements significantly. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists, indicating no confirmed widespread in-the-wild exploitation at time of analysis. The release notes for v3.9.2 reveal this fix was bundled with patches for RCE (#9335), SSRF (#9579), path traversal (#9519), and cross-tenant write (#9462), suggesting the codebase had systemic access control weaknesses - defenders should treat the full upgrade as higher priority than the individual CVE score implies.

An attacker with any valid low-privileged JeecgBoot account sends a crafted HTTP POST or GET request to /sys/user/login/setting/userEdit, supplying a manipulated userIdentity value referencing another user's account. Because the server fails to validate that the authenticated session owner matches the requested identity, the attacker gains unauthorized read or write access to that user's settings or data. Since a POC is publicly available via GitHub issue #9596, reproduction requires minimal technical skill beyond possessing a valid platform credential.