CVE-2026-78970
Received Received - Intake

Authorization Bypass in JeecgBoot Exposes User Data

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-78970

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jeecg jeecgboot to 3.9.3 (exc)
jeecgboot jeecgboot to 3.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

JeecgBoot 3.9.2 and earlier has an authorization bypass flaw in the SystemApiController component. An attacker with a valid JWT token can access sensitive API endpoints to retrieve all user data, including names, contact details, and roles, due to missing permission checks and inadequate data protection.

Detection Guidance

To detect this vulnerability, check if your JeecgBoot application is running version 3.9.2 or earlier. Inspect API logs for unauthorized access attempts to endpoints like queryAllUser or queryUsersByUsernames. Monitor network traffic for unusual requests to these endpoints with valid JWT tokens.

Impact Analysis

This vulnerability allows attackers to steal sensitive user information, leading to privacy breaches, identity theft, or unauthorized access to systems. Organizations using JeecgBoot may face data leaks, reputational damage, and potential legal consequences.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and health-related data without proper safeguards. Organizations could face fines, legal actions, and mandatory breach notifications due to non-compliance with data protection requirements.

Mitigation Strategies

Upgrade JeecgBoot to a version later than 3.9.2 immediately. Implement fine-grained permission checks for all API endpoints. Apply data desensitization to sensitive user information in API responses. Review and revoke any potentially compromised JWT tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart