CVE-2026-108677

Received Received - Intake

JeecgBoot Missing Authorization Exposes User Passwords

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-108677

Affected Vendors & Products

Vendor	Product	Version / Range
jeecgboot	JeecgBoot	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the endpoint GET /sys/api/getUserByName. This flaw allows low-privileged authenticated users to retrieve any user's stored password value. The response is protected by AES-CBC encryption but can be decrypted using a hard-coded key exposed by another endpoint /sys/getEncryptedString. Attackers can then obtain ciphertexts of administrators' passwords for offline guessing attempts.

Detection Guidance

To detect this vulnerability, check if your JeecgBoot instance is running version 3.9.5 or earlier. Inspect network traffic for requests to /sys/api/getUserByName with low-privileged user access. Verify if responses contain encrypted password values and if /sys/getEncryptedString is accessible to extract the hard-coded AES-CBC key.

Impact Analysis

If you use JeecgBoot versions up to 3.9.5, low-privileged attackers with network access could exploit this to steal password hashes or ciphertexts. This could lead to unauthorized account access, privilege escalation, or data breaches if weak passwords are used. Systems with sensitive data or administrative users are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face fines or penalties for failing to protect personal or health information due to inadequate access controls. Compliance programs relying on JeecgBoot must address this flaw to maintain regulatory adherence.

Mitigation Strategies

Immediately upgrade JeecgBoot to a version later than 3.9.5 to address the missing authorization flaw. Restrict access to /sys/api/getUserByName and /sys/getEncryptedString endpoints. Rotate all exposed administrator password ciphertexts and enforce strong password policies to mitigate offline guessing risks.

Hi! I’m here to help you understand CVE-2026-108677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70