CVE-2026-108887
Received Received - Intake

JeecgBoot Missing Authorization in SysCommentController ExportXls

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_comment row, including comment text and user ids on records they cannot access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108887
EUVD
EUVD-2026-97061

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jeecgboot JeecgBoot 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108887 is a missing authorization vulnerability in JeecgBoot through version 3.9.5. It allows any authenticated user to export all comments via the /sys/comment/exportXls endpoint, including comment text and user IDs they should not access. The issue stems from insufficient permission checks in the SysCommentController.

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privileged users can access the /sys/comment/exportXls endpoint. Use curl to test: curl -u username:password http://target.com/sys/comment/exportXls. If it returns an Excel file with all comments, the system is vulnerable.

Another method is to test the /sys/comment/listByForm endpoint with arbitrary parameters: curl -u username:password 'http://target.com/sys/comment/listByForm?tableName=any&tableDataId=1'. If it returns comments from other users, authorization is missing.

Impact Analysis

An attacker could exploit this to steal sensitive comment data, including private messages or internal discussions, by downloading the entire sys_comment table. This could lead to data breaches, privacy violations, or unauthorized access to confidential information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive data without proper authorization. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. Exploitation could result in non-compliance penalties.

Mitigation Strategies

Immediately update JeecgBoot to a version that includes the authorization fix, specifically versions released after June 17, 2026. If an update is not possible, restrict access to the /sys/comment/exportXls and /sys/comment/listByForm endpoints via web server rules or firewall.

Review all authenticated users' access levels and ensure least privilege principles are applied. Monitor logs for unusual access to comment-related endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart