CVE-2026-58377: JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, and delete all AK/SK credential pairs, with the list endpoint returning secret keys in plaintext, enabling credential theft and unauthorized invocation of the OpenAPI surface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JeecgBootto a version that resolves this vulnerability.Fixed in 3.9.2 - Compensating control
Restrict network/API access to OpenApiAuthController and OpenApiPermissionController endpoints so that only appropriately privileged users/systems can reach them, since these OpenAPI credential management endpoints lack Shiro authorization annotations in JeecgBoot 3.9.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58377?
CVE-2026-58377 has a high severity score of 8.1.
How do I fix CVE-2026-58377?
To fix CVE-2026-58377, you should update JeecgBoot to the latest version that includes patching for the broken access control vulnerability.
What is the impact of CVE-2026-58377?
CVE-2026-58377 allows low-privilege authenticated users to perform unauthorized operations on OpenAPI credentials, including creating, reading, updating, and deleting sensitive data.
Which components are affected by CVE-2026-58377?
CVE-2026-58377 affects the OpenApiAuthController and OpenApiPermissionController endpoints of JeecgBoot.
Who is vulnerable to CVE-2026-58377?
Authenticated low-privilege users of JeecgBoot versions up to 3.9.2 are vulnerable to CVE-2026-58377.