EUVD-2026-96616
GHSA-ghh4-x4m2-g9rc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCall /sys/api/getUserByName for admin
-
ExploitRetrieve encrypted password value
-
ExecutionFetch hard-coded key via /sys/getEncryptedString
-
PersistDecrypt ciphertext offline
-
ImpactCrack/reuse admin credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated JeecgBoot account (PR:L) able to reach the GET /sys/api/getUserByName endpoint over the network; no user interaction or admin privileges are needed. Full credential recovery additionally depends on the platform exposing the hard-coded AES-CBC key via /sys/getEncryptedString, enabling offline decryption of the returned password ciphertext. The primary limiting factor is the authentication requirement - an attacker must first obtain or be granted any account - and successful admin takeover further depends on the offline crackability of the decrypted password value. Applies to JeecgBoot deployments through version 3.9.5. |
| Impact | This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) is internally consistent with the description: network-reachable, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated low-privileged account, which meaningfully limits blast radius versus a pre-auth flaw. Impact is confidentiality-only (VC:H, VI:N/VA:N), consistent with disclosure of password ciphertexts rather than direct compromise. A public POC exists (VulnCheck-reported), raising practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - treat this as exploitable-in-principle rather than mass-exploited. The real severity amplifier is the chained design weakness: the same platform exposes a hard-coded AES-CBC key via /sys/getEncryptedString, turning retrieved ciphertexts into recoverable plaintext for offline cracking, which can escalate a low-privilege account toward administrator credential compromise. No signals directly conflict; the main missing data is EPSS/KEV, so widespread-exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privileged JeecgBoot account calls GET /sys/api/getUserByName for the admin username and receives the admin's stored (AES-CBC encrypted) password value, which should not be exposed to them. They then retrieve the hard-coded key from /sys/getEncryptedString, decrypt the ciphertext offline, and crack or directly reuse the administrator credential. A public POC (poc_sys_api_credential_family.py) automating this chain is already available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext through the GET /sys/api/getUserByName endpoint, which lacks authorization checks. Because the platform exposes its hard-coded AES-CBC encryption key via /sys/getEncryptedString, an attacker holding only a basic account can decrypt the returned password values locally and then subject administrator credentials to offline guessing. Publicly available exploit code exists, and exploitation requires a valid low-privileged account (PR:L) with network reachability, making this a genuine but moderate-priority credential-disclosure issue rather than an unauthenticated critical flaw; no CISA KEV entry indicates confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis, so administrators should apply compensating controls immediately. First, block or disable the GET /sys/api/getUserByName and /sys/getEncryptedString routes at the reverse proxy, gateway, or Spring Security layer so that only trusted administrative IPs can reach them; the trade-off is that any legitimate internal integrations calling those APIs will break and must be migrated or allow-listed. Second, remove the hard-coded AES-CBC key from the exposed endpoint or rotate it and move key material into an external secret store, accepting that changing the key invalidates previously encrypted stored values and may require a re-encryption migration. Third, restrict network exposure of the JeecgBoot admin interface to a VPN or management network and enforce least privilege so that ordinary accounts cannot enumerate usernames. Fourth, treat stored password ciphertexts as compromised: force administrator password resets and audit for anomalous calls to /sys/api/getUserByName and /sys/getEncryptedString in web access logs. Monitor the JeecgBoot project and the VulnCheck advisory for a fixed release, and upgrade as soon as an exact patched version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Spring Boot / Java-based low-code development platform, and the flaw is a classic CWE-862 Missing Authorization defect in org.jeecg.modules.api.controller.SystemApiController (lines 100-110 of the referenced source revision). The /sys/api/getUserByName route returns a user's stored password value - stored as AES-CBC ciphertext - without verifying that the caller is entitled to that record or holds an administrative role, so any authenticated principal can enumerate arbitrary usernames and harvest their credential ciphertexts. The confidentiality impact is amplified by a second design weakness: the hard-coded AES-CBC symmetric key is itself retrievable through the /sys/getEncryptedString endpoint, so the encryption offers no meaningful protection once the key is exposed. All JeecgBoot builds captured under CPE cpe:2.3:a:jeecgboot:jeecgboot:* are in scope through 3.9.5, and the AES key exposure plus ciphertext export enables fully offline password cracking using tools such as hashcat or John the Ripper once the ciphertext has been decrypted, with success depending on the strength of the underlying password.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint abusable by any authenticated low-privileged user (PR:L, AC:L); impact is disclosure of credential ciphertexts (C:H) with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.
Technical POC Analysis
CWE-862 (Missing Authorization) in JeecgBoot's internal service API controller.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
JeecgBoot versions up to 3.9.5 contain a high-severity credential disclosure vulnerability that enables any authenticated low-privileged user to obtain and decrypt stored password ciphertext for all users, including administrators. Because publicly available exploit code exists, this flaw presents a substantial risk of privilege escalation and unauthorized access to sensitive systems. Leadership should prioritize immediate mitigations and consider the potential for widespread compromise if administrator credentials are successfully cracked.
Restrict network access to the vulnerable endpoints, implement authorization checks in application code, rotate all user credentials, deploy WAF rules to detect and block exploitation, and monitor logs for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reass
Exploit-DB