CVE-2026-108654: JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file names and direct storage URLs of files uploaded by other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated JeecgBoot user can exploit it. The attacker must know an object-storage file record ID.
What information can be exposed?
The affected handler can disclose original uploaded file names and direct storage URLs for files uploaded by other users. The described impact is read access to object-storage file records.
Which endpoint should defenders review for exposure?
Review GET /sys/oss/file/queryById, implemented by the OssFileController queryById handler. Requests by low-privileged accounts for record IDs belonging to other users indicate potential unauthorized access.