CVE-2026-11464: JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure
A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modules\system\controller\SysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the queryPageList endpoint or restrict its access to administrative/internal users only (remove or block routing to src/main/java/org/jeecg/modules/system/controller/SysUserController.java queryPageList) until a vendor patch is available.
JeecgBoot SysUserController (User List Endpoint) queryPageList access = disabled or restricted to admin/internal network - Compensating control
Restrict external access to the User List Endpoint (queryPageList) using network controls (firewall, WAF, API gateway) to trusted IPs or require strong authentication; deploy WAF/IDS rules to detect and block exploit attempts while awaiting the vendor fix.
- Operational
Monitor application and access logs for calls to queryPageList and indicators of exploitation of the publicly available exploit. Track the vendor release and apply the official patch as soon as it becomes available; test the fix in staging before production deployment.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11464?
The severity of CVE-2026-11464 is low, rated at 3.1.
What does CVE-2026-11464 affect?
CVE-2026-11464 affects the queryPageList function in the SysUserController.java file of the JeecgBoot component.
What type of vulnerability is CVE-2026-11464?
CVE-2026-11464 is classified as an information disclosure vulnerability.
How can I mitigate CVE-2026-11464?
Mitigation for CVE-2026-11464 involves updating to the latest version of JeecgBoot that addresses this vulnerability.
What impact does CVE-2026-11464 have?
The impact of CVE-2026-11464 includes potential exposure of sensitive information through unauthorized access.