CVE-2026-108887: JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and user ids on records they cannot access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. No user interaction is required.
What data can be exposed?
The export endpoint can download all rows from sys_comment, including comment text and user IDs for records the requesting user is not authorized to access.
How can I determine whether an instance is affected?
Instances running JeecgBoot through version 3.9.5 are affected according to the available information. Review whether authenticated users can request /sys/comment/exportXls and receive comments beyond those they are permitted to access.