CVE-2026-78970: JeecgBoot vulnerability
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs any valid JWT token. The issue does not require privileged roles because the affected endpoints lack fine-grained permission checks.
What information can be exposed?
The affected APIs can disclose user records across the deployment, including real names, phone numbers, email addresses, employee numbers, and role definitions.
Which API endpoints are identified as affected?
The identified endpoints include queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds in the SystemApiController component.
Which versions are affected?
JeecgBoot 3.9.2 and earlier are identified as affected.