CVE-2026-108650: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs network access to the affected endpoint and a valid authenticated session.
What information can an attacker obtain?
An attacker can provide an arbitrary userId to GET /sys/api/getUserPermissionSet and retrieve that user's complete permission-code set. This includes permission sets belonging to administrator accounts.
Are unauthenticated deployments affected?
The available information indicates authentication is required. The vulnerability is an authorization failure after authentication, allowing a user to query permission data for accounts other than their own.
How can I check whether an instance is vulnerable?
Using a low-privileged authenticated account, request /sys/api/getUserPermissionSet with the userId of a different account. If the response returns the other account's permission codes, the instance is affected.