CVE-2026-108651: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs to be able to send a GET request to /sys/api/getRolesByUserId.
What information can an attacker obtain?
An attacker can provide arbitrary userId values and retrieve the corresponding users' role codes. This can be used to enumerate role assignments and identify administrator accounts.
Which deployments are affected?
JeecgBoot versions through 3.9.5 are affected. The available information does not identify any configuration prerequisite beyond having an authenticated user account.