CVE-2026-108678: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker only needs network access to the application and a valid login.
What information can an attacker obtain?
An attacker can submit GET requests to /sys/api/queryUserRoles using arbitrary usernames and read the corresponding role codes. This can be used to enumerate role assignments and identify accounts with administrator roles.
Does exploitation require changing data or user interaction?
No. The issue is exploitable through a GET request, requires no user interaction, and is described as exposing role information rather than modifying data or affecting availability.