JeecgBoot Missing Authorization Exposes User Permissions

Executive Summary

CVE-2026-108866 is a missing authorization vulnerability in JeecgBoot through version 3.9.5. It allows authenticated users to read any account's permissions by supplying an arbitrary userId parameter to the /sys/api/queryUserAuths endpoint. The endpoint lacks proper authorization checks, enabling low-privileged attackers to retrieve another user's complete permission set and identify administrator accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /sys/api/queryUserAuths endpoint is accessible without proper authorization. Use a tool like curl to send a request with a valid JWT token and an arbitrary userId parameter. Example: curl -H 'Authorization: Bearer <JWT_TOKEN>' http://<TARGET>/sys/api/queryUserAuths?userId=1. If the endpoint returns permission data without rejecting the request, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged attackers to escalate privileges by accessing sensitive permission data of other users. Attackers can identify administrator accounts and potentially perform unauthorized actions. The impact includes unauthorized access to system functions and data, leading to potential data breaches or further exploitation within the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating privacy and security requirements under GDPR and HIPAA. It may result in non-compliance due to unauthorized data exposure, lack of proper access controls, and potential data breaches affecting protected health or personal information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5 if available. If not, restrict access to the /sys/api/queryUserAuths endpoint by implementing proper authorization checks, such as adding @RequiresPermissions annotations. Ensure all API endpoints validate user permissions before processing requests.

Useful 0 Not Useful 0