EUVD-2026-40364
GHSA-6w4x-5vf2-7756
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege JeecgBoot account
-
DeliveryAuthenticate and reach OpenApi controllers
-
ExploitCall unauthorized credential list endpoint
-
ExecutionHarvest plaintext AK/SK secret keys
-
ImpactInvoke OpenAPI or alter/delete credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated low-privilege JeecgBoot session (CVSS PR:L) - the OpenApiAuthController and OpenApiPermissionController endpoints are network-reachable and need no user interaction, but they are not anonymously exploitable. The specific precondition is that the JeecgBoot OpenAPI feature is deployed and exposed, and that the affected controllers lack Shiro authorization annotations (true by default in versions through 3.9.2). The main limiting factor is account access: an attacker must first hold any low-privilege credential, so environments with closed registration and tight account governance face a higher bar than multi-tenant or self-service deployments. No special platform, non-default configuration, or elevated role is otherwise required. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 and is internally consistent with the description: network-reachable, low complexity, only low privileges required, no user interaction, with high confidentiality and integrity impact and no availability impact. The PR:L requirement is the main limiting factor - an attacker needs a valid low-privilege account first, so this is not anonymous internet-wide exploitation, but in multi-tenant or self-registration deployments that bar is trivial. Exploit code is publicly available (referenced from the JeecgBoot GitHub issue tracker) and the finding comes from VulnCheck, which raises real-world risk above a theoretical authorization gap. No EPSS score and no SSVC decision data were provided, and the CVE is not in CISA KEV, so there is no evidence of active in-the-wild exploitation yet; the combination of a public POC, plaintext secret-key disclosure, and a low privilege bar makes this a credible near-term priority rather than a high-CVSS-but-low-real-risk issue. |
| Exploit ScenarioDerived | An attacker registers or obtains any ordinary low-privilege JeecgBoot account, authenticates, and sends a request to the unprotected OpenApiAuthController list endpoint, which returns every AK/SK pair with secret keys in plaintext. Using AV:N/AC:L and the public POC, the attacker harvests valid credentials and then either invokes the OpenAPI surface as a trusted client or uses the edit/delete endpoints to tamper with or remove credential pairs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 30, 2026
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController and OpenApiPermissionController endpoints, which are missing Shiro authorization annotations, to fully manage OpenAPI AK/SK credentials. Because the list endpoint returns secret keys in plaintext, any logged-in user can harvest every Access Key/Secret Key pair and then create, modify, or delete them, enabling credential theft and unauthorized invocation of the OpenAPI surface. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
Earlier versions of this analysis (2)
Broken access control in JeecgBoot through 3.9.2 lets any authenticated low-privilege user perform full CRUD on OpenAPI AK/SK credential pairs because the OpenApiAuthController and OpenApiPermissionController endpoints ship without Shiro authorization annotations. The list endpoint returns secret keys in plaintext, so an attacker with any low-privilege account can harvest every credential and invoke the OpenAPI surface as a trusted client. Publicly available exploit code exists (VulnCheck advisory and JeecgBoot issue #9705); there is no public exploit identified as active in CISA KEV, and no EPSS score was provided.
Broken access control in JeecgBoot through 3.9.2 lets any authenticated low-privilege user fully manage OpenAPI AK/SK credentials because the OpenApiAuthController and OpenApiPermissionController endpoints ship without Shiro authorization annotations. The list endpoint discloses secret keys in plaintext, so an attacker can harvest every Access/Secret key pair and impersonate the OpenAPI surface. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified at time of analysis - the only references are the JeecgBoot GitHub issue (https://github.com/jeecgboot/JeecgBoot/issues/9705) and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-missing-authorization-on-openapi-credential-management-endpoints-exposes-access-secret-keys); monitor both for a fixed release and upgrade as soon as one is published. As a compensating control, add the missing Shiro authorization annotations (or an equivalent permission interceptor) to the OpenApiAuthController and OpenApiPermissionController methods so the credential endpoints require an OpenAPI-admin permission, which is the precise root-cause fix but requires building from source. Where code changes are not feasible, restrict access to the OpenAPI credential management routes at a reverse proxy or gateway (allowlist only administrator IPs/roles), with the trade-off that legitimate non-allowlisted admins lose access; also rotate all existing AK/SK pairs after locking down the endpoints since secrets may already have been exposed in plaintext, accepting that rotation will break any integrations using the old keys until they are re-provisioned.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source Java low-code development platform that uses Apache Shiro for authentication and authorization, typically enforced via annotations (e.g. @RequiresPermissions/@RequiresRoles) on controller methods. The root cause is CWE-862 (Missing Authorization): the OpenApiAuthController and OpenApiPermissionController endpoints that govern OpenAPI credential management omit those Shiro authorization annotations, so the framework authenticates the session but never checks whether the caller is entitled to the OpenAPI credential functions. The OpenAPI mechanism relies on AK/SK (Access Key/Secret Key) pairs for machine-to-machine API authentication; exposing the secret key in plaintext through an unauthorized list endpoint collapses that trust model. The single CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* covers all versions up to and including 3.9.2.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoints with low complexity and only a low-privilege account (PR:L); plaintext secret disclosure gives C:H and credential CRUD gives I:H, with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
Executive ViewAI
JeecgBoot versions through 3.9.2 contain a critical access control vulnerability enabling any authenticated user to extract and manipulate OpenAPI credentials stored in plaintext, compromising the security of integrated external systems and APIs. Organizations using affected versions face immediate risk of insider credential theft and unauthorized programmatic access to dependent services.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to OpenApiAuthController and OpenApiPermissionController endpoints to administrative IP ranges only; (2) implement application-level access controls requiring elevated authentication for credential management functions; (3) enable real-time alerting on credential retrieval, creation, modification, or deletion; (4) disable OpenAPI credential management functionality if not operationally required; (5) rotate all active OpenAPI AK/SK pairs monthly; (6) audit user access logs for suspicious credential operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB