EUVD-2026-31973
GHSA-q7x2-2w32-gxv3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded.
AnalysisAI
Improper access control in JeecgBoot versions up to 3.9.1 allows authenticated low-privileged remote attackers to bypass authorization checks by manipulating the userIdentity argument in the SysUser component's user.getUsername function at the /sys/user/login/setting/userEdit endpoint. A publicly available proof-of-concept exploit exists via GitHub issue #9596, increasing practical risk for any multi-user JeecgBoot deployment where adversaries hold a low-privileged account. Vendor-released patch v3.9.2 is available and explicitly remediates this access control failure alongside several other high-severity issues including RCE and SSRF, indicating a broad security hardening effort in this release cycle.
Technical ContextAI
JeecgBoot is a Java-based open-source low-code platform. The vulnerability is rooted in CWE-284 (Improper Access Control), meaning the server-side logic handling the /sys/user/login/setting/userEdit API endpoint fails to enforce proper authorization when the userIdentity parameter is supplied by a caller. The user.getUsername function in the SysUser component accepts this parameter without adequately verifying whether the authenticated caller has rights to act on behalf of or access the identity being specified. This class of flaw commonly arises when applications trust client-supplied identity references without server-side cross-checking against session ownership or role bindings. The affected CPE is cpe:2.3:a:n/a:jeecgboot:*:*:*:*:*:*:*:* covering all releases through 3.9.1. The CVSS temporal vector includes E:P (proof-of-concept exploit exists) and RL:O (official fix released), both of which are corroborated by the GitHub evidence.
RemediationAI
Upgrade to JeecgBoot v3.9.2 immediately; this is the vendor-released patch confirmed by the official GitHub release at https://github.com/jeecgboot/JeecgBoot/releases/tag/v3.9.2. The v3.9.2 release also patches multiple other high-severity issues (RCE, SSRF, path traversal, cross-tenant write), making this upgrade broadly critical beyond the scope of this single CVE. If an immediate upgrade is not possible, restrict network access to the /sys/user/login/setting/userEdit endpoint via firewall rules or reverse-proxy ACLs, limiting it to only trusted IP ranges or administrative networks - this reduces the AV:N attack surface but does not eliminate insider risk from already-authenticated users. Additionally, audit existing user accounts for unauthorized privilege escalation that may have already occurred via this vector. Note that endpoint restriction is a temporary control only; it does not fix the underlying access control flaw and must be replaced by the vendor patch.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today