JeecgBoot Missing Authorization Exposes User Details

Executive Summary

CVE-2026-108891 is a missing authorization vulnerability in JeecgBoot versions up to 3.9.5. It allows any authenticated user to access other users' sensitive details by supplying arbitrary user IDs to the SysUserController getUserDetailByUserId handler. This includes personally identifiable information like real names, emails, phone numbers, birthdays, employee numbers, department paths, and posts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint /sys/user/getUserDetailByUserId?userId= returns user details when accessed by an authenticated user with low privileges. Use a tool like curl to send a request with a valid session token and arbitrary userId values. Example: curl -H 'Authorization: Bearer <token>' 'http://target.com/sys/user/getUserDetailByUserId?userId=1'

If the response includes sensitive fields like email, phone, or real name without proper authorization, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers can exploit this to steal sensitive user data, leading to privacy breaches, identity theft, or targeted phishing attacks. Organizations using vulnerable JeecgBoot versions risk unauthorized access to employee or customer information, potentially violating trust and regulatory requirements.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personally identifiable information without proper authorization. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. Exploits could lead to non-compliance fines and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version later than 3.9.5 where this vulnerability is patched. If an update is not available, restrict access to the /sys/user/getUserDetailByUserId endpoint to authorized users only.

Review user permissions and ensure least privilege access. Monitor logs for unauthorized access attempts to sensitive endpoints.

Useful 0 Not Useful 0