CVE-2026-108627: JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need elevated role-management permissions.
What access does an attacker need?
The attacker needs valid credentials and network access to the JeecgBoot instance. They can send a GET request to /sys/role/datarule/{permissionId}/{roleId} using target permission and role identifiers.
What information can be exposed?
The endpoint can disclose role data-rule details, including rule names, columns, conditions, values, and identifiers of rules bound to roles.
How can defenders check for possible exploitation?
Review application or proxy logs for GET requests to /sys/role/datarule/ made by accounts that should not be able to view role data rules. Investigate requests targeting role or permission identifiers outside the requesting user's authorized scope.