EUVD-2026-96616

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-108677

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the GET /sys/api/getUserByName endpoint. This vulnerability allows low-privileged authenticated users to retrieve the stored password values of any user. Attackers can further decrypt the AES-CBC pro...