CVE-2026-108866: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker needs to be able to send a request to the queryUserAuths handler with an arbitrary userId parameter.
What information can an attacker obtain?
An attacker can retrieve another account's complete permission set. This can expose permission assignments and help identify administrator accounts.
Are unauthenticated attackers affected?
The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is sufficient.
How can I determine whether the issue applies to my deployment?
Deployments of JeecgBoot through version 3.9.5 are identified as affected. You can also assess exposure by using a low-privileged authenticated account and verifying whether queryUserAuths returns permissions for a different userId.