CVE-2026-108886: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername

Q: Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need user interaction and can make requests over the network.

Q: What information can an attacker obtain?

An attacker can provide arbitrary userId values to retrieve other users' account records. Exposed data includes names, email addresses, phone numbers, employee numbers, department assignments, and staff lists for departments headed by those users.

Q: How can I determine whether my deployment is affected?

Deployments running JeecgBoot through version 3.9.5 are affected according to the available information. Testing should verify whether a low-privileged authenticated account can call /sys/user/queryChildrenByUsername with another user's userId and receive that user's records.

Published Oct 11, 2026

Updated

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.

Affected Software

1 affected component

JeecgBoot JeecgBoot<=3.9.5

Event History

Oct 11, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need user interaction and can make requests over the network.

What information can an attacker obtain?

An attacker can provide arbitrary userId values to retrieve other users' account records. Exposed data includes names, email addresses, phone numbers, employee numbers, department assignments, and staff lists for departments headed by those users.

How can I determine whether my deployment is affected?

Deployments running JeecgBoot through version 3.9.5 are affected according to the available information. Testing should verify whether a low-privileged authenticated account can call /sys/user/queryChildrenByUsername with another user's userId and receive that user's records.

CVE-2026-108886: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

How can I determine whether my deployment is affected?