CVE-2026-108674: JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged authenticated JeecgBoot account. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What information could be exposed?
The endpoint can disclose OpenAPI definitions, including internal origin URLs, virtual paths, IP allowlists, and header and parameter templates. This information may help an authenticated user map internal services or prepare follow-on requests.
Are deployments without OpenAPI permissions affected?
Yes. The issue specifically allows authenticated low-privileged users to read definitions through /openapi/queryById even when they do not have openapi permissions.
What can be done while a fix is unavailable?
Restrict access to GET /openapi/queryById so that low-privileged accounts cannot reach it, and limit network exposure of the endpoint where possible. Review access to OpenAPI definition entries because an attacker must supply an entry ID.