JeecgBoot EUVD-2026-31587

Remote network access to the JeecgBoot application's /openapi/call/ endpoint is required (AV:N). Exploitation requires high attack complexity (AC:H) and is rated difficult, indicating specific preconditions beyond simple unauthenticated access. Likely prerequisites include: detailed knowledge of JeecgBoot's OpenAPI request structure and authentication flow, ability to craft precisely formatted API calls that trigger the authentication bypass condition, and potentially timing-dependent or race condition exploitation. No authentication is required to initiate the attack (PR:N), but the authentication bypass itself must be successfully triggered. No user interaction needed (UI:N). What limits exploitation: The AC:H rating and 'difficult exploitability' assessment suggest attackers need specialized knowledge of the vulnerability mechanism rather than simple script execution. The low integrity impact (I:L) indicates successful exploitation provides restricted unauthorized capabilities-possibly limited to specific API operations, non-sensitive data modification, or requires additional steps to achieve meaningful compromise. Deployments where the OpenAPI endpoint is not network-exposed or is protected by upstream authentication layers (API gateway, WAF with strong auth) are not vulnerable.

Real-world risk assessment reveals mixed signals requiring careful interpretation. CVSS 3.7 rates this Low severity with limited impact (C:N/I:L/A:N - only minor integrity impact, no confidentiality or availability loss), suggesting successful exploitation provides restricted unauthorized capabilities rather than full system compromise. The AC:H (high complexity) and 'difficult exploitability' assessment indicate non-trivial prerequisites that reduce likelihood of widespread automated exploitation. However, the authentication bypass nature (CWE-287) on a remotely accessible network endpoint (AV:N/PR:N) creates inherent architectural concern for API security. CRITICAL DATA GAPS: No EPSS score provided to validate real-world exploitation probability. No CISA KEV listing confirms this is not actively exploited in the wild. No public POC available reduces immediate weaponization risk. Vendor non-responsiveness per description creates uncertainty about patch timeline and whether the vulnerability assessment is accurate. The I:L (low integrity impact) suggests exploited access is constrained - possibly limited to specific API operations or data modification rather than full authentication bypass. Organizations running JeecgBoot 3.9.1 with exposed OpenAPI endpoints should prioritize investigation, but this is not a critical emergency patch scenario given difficulty and limited impact ratings.

A remote attacker maps the exposed JeecgBoot application and identifies the /openapi/call/ endpoint through reconnaissance. By crafting specially formatted API requests that exploit the authentication logic flaw-potentially through parameter manipulation, token reuse, or race conditions given the high complexity rating-the attacker bypasses authentication checks and gains limited unauthorized access to API functions. The attacker could potentially modify specific data or invoke restricted API operations, though the low integrity impact suggests access is constrained to non-critical functions or requires chaining with other vulnerabilities for significant impact. No public proof-of-concept code exists at time of analysis.