CVE-2026-108655: JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated user can exploit it. The attacker needs a valid job ID to request the affected endpoint and read the corresponding scheduled-job record.
What information can be exposed?
The affected handler can disclose scheduled job class names, cron expressions, job parameters, and job status. These records are intended to be reserved for administrators.
How can I determine whether my deployment is affected?
JeecgBoot versions through 3.9.5 are identified as affected. Test whether a low-privileged authenticated account can send GET requests to /sys/quartzJob/queryById for a job ID and receive scheduled-job details.