CVE-2026-108866: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs to be able to send a request to the queryUserAuths handler with an arbitrary userId parameter.

Q: What information can an attacker obtain?

An attacker can retrieve another account's complete permission set. This can expose permission assignments and help identify administrator accounts.

Q: Are unauthenticated attackers affected?

The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is sufficient.

Q: How can I determine whether the issue applies to my deployment?

Deployments of JeecgBoot through version 3.9.5 are identified as affected. You can also assess exposure by using a low-privileged authenticated account and verifying whether queryUserAuths returns permissions for a different userId.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Event

via NVD·04:47 PM

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs to be able to send a request to the queryUserAuths handler with an arbitrary userId parameter.

What information can an attacker obtain?

An attacker can retrieve another account's complete permission set. This can expose permission assignments and help identify administrator accounts.

Are unauthenticated attackers affected?

The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is sufficient.

How can I determine whether the issue applies to my deployment?

Deployments of JeecgBoot through version 3.9.5 are identified as affected. You can also assess exposure by using a low-privileged authenticated account and verifying whether queryUserAuths returns permissions for a different userId.

CVE-2026-108866: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated attackers affected?

How can I determine whether the issue applies to my deployment?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are unauthenticated attackers affected?

How can I determine whether the issue applies to my deployment?