CVE-2026-108886: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. The attacker does not need user interaction and can make requests over the network.
What information can an attacker obtain?
An attacker can provide arbitrary userId values to retrieve other users' account records. Exposed data includes names, email addresses, phone numbers, employee numbers, department assignments, and staff lists for departments headed by those users.
How can I determine whether my deployment is affected?
Deployments running JeecgBoot through version 3.9.5 are affected according to the available information. Testing should verify whether a low-privileged authenticated account can call /sys/user/queryChildrenByUsername with another user's userId and receive that user's records.