CVE-2026-108867: JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes and identify administrator accounts without the system:user:queryUserRole permission.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need the system:user:queryUserRole permission.
What does an attacker need to provide?
The attacker needs to send a request to /sys/api/getUserRoleSetById with an arbitrary userId parameter. This allows them to retrieve the role codes assigned to the specified user.
What information could be exposed?
The issue exposes other users' role assignments. An attacker can use the returned role codes to identify accounts with administrator roles.
Which versions are affected?
JeecgBoot through version 3.9.5 is affected.