JeecgBoot EUVD-2026-96589

Requires an authenticated session as any user of the JeecgBoot instance (CVSS PR:L) - exploitation is not possible pre-authentication, and the specific endpoint GET /sys/api/getUserPermissionSet must be reachable. No user interaction, no special non-default feature, and no elevated privileges are needed beyond a basic valid account; the handler fails to validate that the requester is authorized to read the supplied userId. The principal limiting factor is the requirement for a valid low-privileged login, which constrains this to insiders, compromised accounts, or environments that allow self-registration/guest accounts; impact is also limited to disclosure of permission codes (confidentiality only), not direct data modification or account takeover.

This is a genuine but moderate-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity flaw that nonetheless requires PR:L - a valid authenticated low-privileged account - and yields only low confidentiality impact with no integrity or availability effect, matching the 5.3 (Medium) score. The vulnerability is a missing-authorization / IDOR-class defect (CWE-862): any logged-in user can substitute an arbitrary userId to read another account's permission codes, including an administrator's. Publicly available exploit code exists (a VulnCheck-referenced PoC), which raises the practical likelihood of opportunistic use, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation at this time. The real-world weight of this bug is as a reconnaissance primitive: it leaks the authorization model of privileged accounts (not credentials or data directly), which is most dangerous when chained with a separate privilege-escalation or authorization-enforcement weakness. Treat as a confirmed-fixable medium that should be patched promptly on internet-exposed or multi-tenant JeecgBoot deployments, but it is not a drop-everything critical.

A low-privileged but authenticated JeecgBoot user (or an attacker who has obtained any valid session) sends GET /sys/api/getUserPermissionSet with the userId of an administrator account. The handler returns that account's full permission set without verifying the requester's authorization, exposing the privileged account's capability map. A public PoC (poc_c096_sys_api_permission_set.py) demonstrates the request, so exploitation requires no custom tooling.