EUVD-2026-96588
GHSA-8qxr-46x4-p4xq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated session
-
ExploitCall GET /sys/api/queryUserRolesById with target userId
-
ExecutionEnumerate role codes across user IDs
-
ImpactIdentify administrator accounts for targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated session on the JeecgBoot application (PR:L); the attacker must be able to reach the /sys/api/queryUserRolesById endpoint of SystemApiController over the network. No user interaction, special configuration, or administrative access is needed - the missing authorization check applies in default configurations, so any authenticated user can supply an arbitrary userId. The primary limiting factor is the authentication prerequisite: a completely unauthenticated outsider cannot exploit it directly, and the impact is confined to disclosure of role codes (no data modification or service disruption). |
| Impact | This is a genuine but low-to-moderate priority issue, not a critical emergency. The CVSS 4.0 base score of 5.3 (Medium) reflects the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N - network-reachable, low attack complexity, but requiring low-privilege authentication (PR:L) and yielding only low confidentiality impact (VC:L) with no integrity or availability effect. The flaw is an information-disclosure/missing-authorization weakness (CWE-862), not remote code execution: an already-authenticated user can enumerate other users' role codes. Publicly available exploit code exists (a Python POC on GitHub) and the issue was reported by VulnCheck, which raises practical exploitability, but the vulnerability is NOT listed in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation. The signals are internally consistent: a modest-impact, auth-required disclosure bug with a working POC - realistically a reconnaissance/privilege-mapping primitive (identifying admin accounts) rather than a standalone high-impact compromise. No EPSS data is present in the input, so probabilistic exploitation likelihood cannot be quantified. Treat this as a chainable info-leak to patch in normal cycles, prioritized higher where low-privilege accounts are widely provisioned. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has obtained any valid low-level account) sends a GET request to /sys/api/queryUserRolesById with an arbitrary userId value and receives that user's role codes in response. By iterating userId values, the attacker maps the role assignments of the entire user base and identifies administrator accounts to target in a follow-on attack. A public Python POC for this request exists, lowering the skill barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user to read arbitrary accounts' role codes by supplying a userId to the queryUserRolesById handler of SystemApiController, enabling enumeration of role assignments and identification of administrator accounts. Exploitation requires only a valid low-privilege session (CVSS 4.0 vector shows PR:L, no user interaction) and publicly available exploit code exists, while there is no evidence of confirmed active exploitation (no CISA KEV listing in the provided data). Because the flaw is limited to confidentiality with no modification or availability impact, it is a genuine but low-to-moderate priority disclosure issue rather than a critical emergency.
RemediationAI
No vendor-released patch identified at time of analysis - the provided references point to the vulnerable source lines and a VulnCheck advisory rather than a fixed release, so upgrades should be applied to whatever version the vendor publishes beyond 3.9.5 once confirmed (track https://github.com/jeecgboot/JeecgBoot and the advisory at https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-queryuserrolesbyid). Until a fixed build is available, the most effective compensating control is to add an authorization check to the queryUserRolesById handler - a @PreAuthorize/permission annotation or an explicit guard restricting the requested userId to the caller's own identity or to administrative roles; the trade-off is that legitimate cross-user lookups performed by admin tooling or integrations must be re-granted an appropriate permission, otherwise those workflows break. Organizations that cannot modify code should restrict the entire /sys/api/** path at the reverse proxy or gateway so it is reachable only from trusted internal networks or privileged admin sessions, accepting that any external client dependent on the system API will lose access. Reducing the standing privileges of default and self-registered accounts, and disabling self-registration where it is not required, removes the low-privilege foothold this attack depends on but does not remediate the underlying flaw. Rate limiting or alerting on repeated distinct userId values against /sys/api/queryUserRolesById slows and detects role enumeration but leaves the missing authorization check intact, and should be treated only as a monitoring supplement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot / MyBatis-Plus low-code development platform whose system module exposes internal helpers under the /sys/api/* namespace. The affected code is the queryUserRolesById handler in SystemApiController (jeecg-module-system/jeecg-system-biz/.../api/controller/SystemApiController.java, lines 482-485), which accepts a userId parameter and returns that user's role codes without verifying that the caller is entitled to view another user's role bindings. This is CWE-862 (Missing Authorization): a broken function-level access control problem where the endpoint lacks the permission annotation or role check applied to comparable administrative functions, rather than a memory-safety or injection defect. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:* with a wildcard version indicates the advisory covers all releases through 3.9.5. The attack surface is the HTTP GET endpoint /sys/api/queryUserRolesById, which is reachable over the network (AV:N) and exploitable with a low-privilege authenticated context (PR:L), making the authentication prerequisite the principal limiting factor; the disclosed role codes are useful primarily as a reconnaissance primitive for targeting higher-privileged accounts.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N), no special conditions (AC:L), requires a low-privilege authenticated account (PR:L), discloses only role codes so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and identify administrator accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB