EUVD-2026-97061
GHSA-vvcm-q3j3-2gj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any low-privileged account
-
DeliveryAuthenticate to JeecgBoot
-
ExploitRequest /sys/comment/exportXls
-
ExecutionServer skips authorization check
-
PersistDownload full sys_comment export
-
ImpactHarvest comment text and user ids
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session as any low-privileged user (PR:L) and the ability to reach the /sys/comment/exportXls endpoint of a JeecgBoot instance through 3.9.5; no special non-default feature, protocol, or configuration mode is needed because the authorization check is simply absent from the exportXls handler. The only limiting factor is the authentication requirement - there is no anonymous/unauthenticated path and no user interaction by a victim is involved; impact is confined to disclosure of sys_comment data (comment text and user ids), with no write or availability effect. |
| Impact | This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 5.3 (vendor-provided vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is consistent with the description: a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account (PR:L), with confidentiality-only impact (VC:L) and no integrity or availability consequences. Publicly available exploit code exists (a Python POC is referenced and the vulnerability was reported by VulnCheck with a dedicated advisory), which raises practical exploitability, but this is distinct from active exploitation. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of widespread opportunistic exploitation - exploitation status is best characterized as 'publicly available exploit code exists.' The core risk is a broken-access-control information disclosure: an authenticated user can export the entire sys_comment table (comment text and user ids) rather than only authorized records. The main mitigating factor is that an account is required (PR:L), limiting purely anonymous mass abuse; the main aggravating factor is that low-privileged accounts are common in multi-tenant/low-code deployments and a POC is already public. Net: a legitimate access-control bug worth patching, but its real-world severity is bounded by the authentication requirement and the confidentiality-only, no-write impact. |
| Exploit ScenarioDerived | A low-privileged but authenticated JeecgBoot user (or an attacker who has phished/registered any valid account) sends an HTTP GET to /sys/comment/exportXls. Because the handler performs no per-record authorization check, the server returns an XLS export of every row in sys_comment - including comment text and user ids the attacker was never authorized to view. A working Python POC for this request is publicly available, lowering the effort to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
JeecgBoot through 3.9.5 allows any authenticated low-privileged user to export the entire sys_comment table by calling the /sys/comment/exportXls endpoint because the SysCommentController handler lacks an authorization check. This exposes comment text and user IDs on records the attacker cannot normally access, but the impact is limited to information disclosure (no write or availability effect). Publicly available exploit code exists, and authentication as a low-privileged user is required (PR:L); the issue is a modest-priority one, not a top-tier emergency.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a primary mitigation, restrict access to the /sys/comment/exportXls endpoint to administrative roles only-either by adding a proper authorization check (e.g., @RequiresPermissions or @PreAuthorize) directly in the SysCommentController source code or by fronting the application with a reverse proxy or WAF rule that blocks non-admin requests to that path. This blocking approach will prevent legitimate exports for non-admin users, so ensure admin traffic is allowlisted. Because exploit code is publicly available, prioritize applying the restriction on any internet-exposed JeecgBoot instance through 3.9.5, and monitor logs for requests to /sys/comment/exportXls that originate from low-privileged accounts. If a patched version is released, upgrade to a version above 3.9.5 as soon as possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is a Java-based low-code development platform built on Spring Boot, and the SysCommentController resides in the jeecg-system-biz module. The exportXls handler at lines 329-332 of SysCommentController.java lacks any authorization annotation or programmatic permission check (CWE-862: Missing Authorization), unlike other endpoints in the controller. This allows any user who has successfully authenticated-even with minimal privileges-to invoke a bulk export operation that queries the sys_comment table without filtering by ownership or role, exposing all comment records. The CPE string cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:* confirms the affected product is JeecgBoot itself and, combined with the description, indicates versions through 3.9.5 are vulnerable. The flaw requires network access to the application and a valid session token; no special configuration or feature flag is needed. Root cause is purely the absence of an authorization check on a data-export endpoint.
Know when Jeecgboot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote, low-complexity endpoint reachable by any authenticated low-privileged user (PR:L), no UI; confidentiality-only disclosure of comment data (C:L), no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_comment row, including comment text and user ids on records they cannot access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated report data exfiltration in JimuReport (JeecgBoot) through version 2.5.0 lets remote attackers export th
Broken access control in JeecgBoot through 3.9.2 lets authenticated low-privilege users reach the OpenApiAuthController
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrat
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authe
SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictIn
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByC
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext t
Authenticated users of any privilege level on JeecgBoot through 3.9.5 can rewrite DingTalk, WeCom, or Feishu third-party
Exploit-DB