EUVD-2026-96590
GHSA-p42c-xqf6-7f9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged account
-
ExploitCall GET /sys/api/getRolesByUserId with arbitrary userId
-
ExecutionEnumerate role codes across user IDs
-
ImpactIdentify administrator accounts for follow-on targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the target JeecgBoot instance, even if only a low-privileged one (PR:L), so this is not remotely exploitable by fully unauthenticated attackers. Beyond holding any account, no special product configuration, feature flag, or deployment mode is needed - the missing authorization check on the getRolesByUserId handler of SystemApiController applies to the default endpoint GET /sys/api/getRolesByUserId. The limiting factor is the authentication requirement; the practical impact is bounded to disclosure of role codes (reconnaissance), with no direct write or availability effect. |
| Impact | This is a genuine but low-to-moderate priority information-disclosure flaw, not a critical issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score are internally consistent with the description: a network-reachable endpoint reachable by any authenticated low-privileged user, with only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N). Publicly available exploit code exists (a Python POC in the referenced GitHub repo), which raises operational risk, but this is NOT the same as active exploitation - there is no CISA KEV listing and no EPSS value was supplied, so widespread automated exploitation cannot be inferred. The realistic risk is that it functions as a privilege-escalation reconnaissance primitive: an attacker who already holds a low-privileged account can enumerate which userIds map to administrator role codes, feeding a follow-on targeted attack. No conflicting signals were observed - the CVSS vector (PR:L, authenticated) matches the description's 'authenticated users' / 'low-privileged attackers' language. Missing data: no EPSS score and no KEV status were provided, and no vendor patch version is identified, so remediation timing cannot be confirmed from the input. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a JeecgBoot deployment (through 3.9.5) issues repeated GET /sys/api/getRolesByUserId requests, substituting arbitrary userId values. Because the handler performs no authorization check (CWE-862), it returns each target's role codes, letting the attacker enumerate accounts and pinpoint administrators to target next. A public Python POC for this exact endpoint is available, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user, including a low-privileged one, to read the role codes of arbitrary accounts by supplying a chosen userId to the endpoint GET /sys/api/getRolesByUserId. The flaw is a CWE-862 absence of an ownership or permission check in the getRolesByUserId handler of SystemApiController, so a valid session - not administrative rights - is the only prerequisite. Impact is limited to information disclosure useful for reconnaissance (identifying administrator accounts and mapping role assignments), with no write or availability effect; publicly available exploit code exists, and EPSS/KEV data indicate no confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so treat this as 'No vendor-released patch identified at time of analysis' and monitor the JeecgBoot project and the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-getrolesbyuserid) for an update; upgrade to the first release that adds an authorization check to the SystemApiController getRolesByUserId handler once it ships. Until then, apply compensating controls: block or restrict the route GET /sys/api/getRolesByUserId at the reverse proxy or WAF to trusted integration clients only - the trade-off is that legitimate external integrations relying on the /sys/api namespace may break; if the SystemApiController integration API is not used in your deployment, disable or remove that controller/route entirely, accepting loss of that integration surface; enforce an ownership/permission check via a servlet filter or Spring Security interceptor that compares the requested userId against the caller's identity or requires an administrative role, which requires custom code maintenance; and enable audit logging and alerting on repeated /sys/api/getRolesByUserId requests with varying userId values, since the public PoC script (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c095_sys_api_roles.py) enumerates role assignments - logging detects but does not prevent the disclosure. Because exploitation only requires a low-privileged authenticated session, also review account provisioning and remove stale or unnecessary accounts to shrink the attacker pool.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java/Spring Boot low-code development platform, and the affected code lives in the jeecg-system-biz module's SystemApiController under the /sys/api/ integration namespace (source reference points to lines 155-158 of that controller). The root cause is CWE-862 (Missing Authorization): the getRolesByUserId handler returns role code data for whatever userId the caller supplies, without verifying that the caller is entitled to view that user's role assignments. Because the endpoint is reachable through a normal authenticated session and the CVSS 4.0 vector records PR:L (and the independent CVSS 3.1 assessment confirms AV:N/AC:L/PR:L/UI:N with C:L, I:N, A:N), the exposure is bounded to confidentiality of role metadata; there is no privilege escalation primitive in the component itself and no integrity or availability impact. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* reflects that all released versions up to and including 3.9.5 are affected, and the public PoC script targets this exact /sys/api/getRolesByUserId route.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint needing any authenticated account (PR:L), no user interaction, limited confidentiality disclosure of role codes only, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB