CVE-2026-7604: JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery
A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7604?
CVE-2026-7604 has a high severity due to its potential for exploitation through server-side request forgery.
What are the affected versions for CVE-2026-7604?
CVE-2026-7604 affects JeecgBoot versions up to and including 3.9.1.
How do I fix CVE-2026-7604?
To fix CVE-2026-7604, update JeecgBoot to a version later than 3.9.1 that addresses the vulnerability.
What is the nature of the vulnerability in CVE-2026-7604?
CVE-2026-7604 is a server-side request forgery vulnerability found in the OpenApiController component of JeecgBoot.
What risks does CVE-2026-7604 pose to my application?
CVE-2026-7604 can allow attackers to send unauthorized requests, potentially exposing sensitive data or services.