EUVD-2026-96594
GHSA-qq99-5fcw-r864
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend GET /sys/quartzJob/queryById?id=<jobid>
-
ExploitMissing authorization check bypassed
-
ExecutionRead admin-only job records
-
ImpactHarvest cron/parameters for recon
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated session on a JeecgBoot instance (version through 3.9.5) reachable over the network; the attacker then issues GET /sys/quartzJob/queryById with a known or guessed job id. No special non-default configuration is needed - the QuartzJobController queryById handler simply lacks the administrator authorization check. Limiting factors: exploitation is gated by possession of any authenticated account (PR:L), and impact is confined to reading scheduled-job metadata (confidentiality only) - there is no write, execution, or denial-of-service capability. |
| Impact | This is a genuine but bounded-severity issue best treated as low-to-moderate priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring a low-privileged authenticated account (PR:L). Impact is confidentiality-only and rated Low (VC:L; VI:N/VA:N) - the flaw exposes sensitive scheduled-job metadata (job class names, cron expressions, parameters, status) to non-admin users but grants no write, code-execution, or availability impact, so it is an information-disclosure/IDOR-class weakness consistent with CWE-862. A public POC exists (publicly available exploit code exists), which lowers the barrier to opportunistic abuse, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active exploitation and widespread automated exploitation cannot be quantified from the input. Signals do not conflict: a moderate CVSS, authenticated-only access, and limited confidentiality impact all point to a real-but-contained issue rather than a critical emergency. The main residual risk is as a reconnaissance/privilege-insight primitive - leaked cron expressions and job parameters could aid an attacker who already has a foothold. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privileged JeecgBoot account (or who has phished/registered one) sends a GET request to /sys/quartzJob/queryById supplying a scheduled-job id. Because the handler omits the administrator authorization check, the server returns job class names, cron schedules, parameters, and status intended only for admins - information useful for mapping internal automation and planning follow-on attacks. A working Python POC for this exact request is publicly published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated low-privileged user read scheduled-job records - class names, cron expressions, job parameters and status - by issuing GET /sys/quartzJob/queryById with a job id, data otherwise reserved for administrators. Publicly available exploit code exists (no CISA KEV entry), and the issue carries a CVSS 5.3 score with an independently assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to confidentiality of job metadata with no write, code-execution or denial-of-service capability. Treat this as a genuine but bounded-severity issue at low-to-moderate priority: exploitation requires a valid low-privileged account against a network-reachable instance and yields only information disclosure that may assist further attacks.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to upgrade to a JeecgBoot release later than 3.9.5 as soon as one is published and to monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-quartzjob-querybyid) and the upstream repository for a fix; self-maintained forks can apply a small code change by adding the same administrator authorization annotation (Shiro @RequiresRoles("admin") / @RequiresPermissions) used by sibling methods to QuartzJobController.queryById before redeploying. Until then, the most effective compensating control is to restrict access to the entire /sys/quartzJob/** path at the reverse proxy, API gateway or Shiro filter chain so that only administrator roles can reach it - this stops the disclosure but will break the scheduled-job management screens for non-admin operators. If scheduled-job administration is unused, disabling or unmapping the QuartzJobController endpoints removes the exposure entirely, at the cost of losing job management functionality. Also treat the returned job parameter maps as potentially compromised: rotate any credentials, tokens or internal URLs embedded in Quartz job data, and add monitoring/alerting for non-administrator requests to /sys/quartzJob/queryById, since the publicly available PoC record_query_by_id.py (https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_record_query_by_id.py) makes retroactive log review practical.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) in the QuartzJobController of JeecgBoot, a Spring Boot low-code development platform that relies on Apache Shiro for authentication and authorization. The affected handler is the queryById method (referenced in the project source at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/quartz/controller/QuartzJobController.java, lines 194-198), which serves GET /sys/quartzJob/queryById and returns a scheduled-job record directly from the Quartz scheduler metadata store. Unlike sibling administrative endpoints in the same module, this handler is not decorated with the administrator authorization annotation/permission check (e.g. Shiro @RequiresPermissions or @RequiresRoles), so any principal holding a valid session - regardless of role - can invoke it and receive the job's class name, cron expression, job parameter map and running status. The parameter map is the sensitive element: Quartz jobs in JeecgBoot are routinely configured with connection strings, tokens or URLs passed as job data, so disclosure can expose internal endpoints and credentials. The CPE cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms the affected component is the JeecgBoot application itself across the vulnerable version line, not a third-party Quartz library - the flaw is an application-level access-control omission in JeecgBoot's own controller layer.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network endpoint reachable by any authenticated low-privileged user (AV:N/AC:L/PR:L/UI:N); only admin-only job metadata is disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB