CVE-2026-108891: JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated JeecgBoot user, including a low-privileged account, can exploit it. No user interaction is required.
What information could be exposed?
An attacker can retrieve details for other users by supplying arbitrary userId values. Exposed data may include real names, usernames, email addresses, phone numbers, birthdays, employee numbers, department paths, and posts.
Which deployments are affected?
JeecgBoot versions through 3.9.5 are affected. The vulnerable functionality is the SysUserController getUserDetailByUserId handler at /sys/user/getUserDetailByUserId.
How can an organization determine whether it is vulnerable?
Using an authenticated low-privileged account, test whether /sys/user/getUserDetailByUserId returns another user's details when given that user's userId. Successful retrieval indicates missing authorization on the handler.