CVE-2026-108648: JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privileged JeecgBoot user can exploit it. The attack is network-accessible and does not require user interaction.
What information can an attacker obtain?
By supplying datasource codes through the dbSourceCode parameter, an attacker can retrieve JDBC URLs, database usernames, and decrypted cleartext database passwords.
Are unauthenticated users affected?
The available information states that authentication is required. It does not indicate that an unauthenticated user can access the endpoint.
How can I determine whether an instance is exposed?
Check whether the instance is JeecgBoot through version 3.9.5 and whether authenticated low-privileged accounts can request GET /sys/api/getDynamicDbSourceByCode. Exposure exists if that endpoint returns datasource credentials for supplied dbSourceCode values without a relevant permission or role check.