JeecgBoot EUVD-2026-96591

Requires a valid authenticated JeecgBoot account of any privilege level (PR:L) that can reach the SystemApiController updateAvatar endpoint over the network; the attacker must be able to send a PUT request supplying an arbitrary target user id plus an avatar value. No user interaction, no admin rights, and no non-default configuration are needed - the flaw is the absence of an ownership/authorization check on the handler. Limiting factors: exploitation is gated on obtaining at least one low-privileged account and on the endpoint being reachable, and the direct impact is confined to modifying the avatar field (LOW integrity), with no inherent confidentiality or availability loss unless the stored avatar value is further abused downstream.

This is a genuine but low-to-moderate priority issue, not a critical emergency. The CVSS 4.0 base score is 5.3 (Medium), and every signal points to limited impact: the vector is AV:N/AC:L/PR:L/UI:N with VC:N/VI:L/VA:N, meaning network-reachable, low-complexity, but requiring a valid low-privileged account and yielding only LOW integrity impact (no confidentiality or availability loss). The vulnerability is missing authorization (CWE-862) in the SystemApiController updateAvatar handler - an authenticated user can overwrite another user's (including an administrator's) avatar value. Publicly available exploit code exists (a VulnCheck-linked GitHub PoC), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - PoC availability and active exploitation are distinct signals and should not be conflated. The realistic ceiling is limited data tampering / stored-content manipulation (e.g., planting an attacker-controlled image URL as an admin's avatar), which could be chained into phishing, UI spoofing, or stored-SSRF/XSS depending on how the avatar value is later rendered or fetched - but the CVE data itself only substantiates unauthorized modification of the avatar field. Net: patch in normal cadence; prioritize above baseline only if JeecgBoot is internet-exposed with many low-privileged accounts.

A low-privileged but authenticated JeecgBoot user (or someone who self-registered/obtained any account) sends a PUT request to the updateAvatar endpoint specifying a victim's user id - such as an administrator - and an attacker-controlled image URL as the avatar value. Because the handler performs no ownership/authorization check, the server accepts the change and replaces the target user's avatar. A working Python PoC is publicly available (poc_sys_api_update_avatar.py), lowering the barrier to reliable exploitation.