CVE-2026-108652

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController updateAvatar handler. This security weakness allows any authenticated user to modify the avatars of other users, including administrators. A low-privileged attacker can exploit this by sendi...

CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108650

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getUserPermissionSet handler of the SystemApiController component. An authenticated, low-privileged attacker can exploit this by supplying an arbitrary userId to the GET /sys/api/getUserPermissionSet endpoint. ...

CVE-2026-108651

The JeecgBoot framework, version 3.9.5 and below, is vulnerable to a missing authorization flaw in the getRolesByUserId handler of the SystemApiController . This vulnerability allows authenticated users to bypass authorization checks by supplying arbitrary userId values via a GET request to /sys/...

CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108650 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...

CVE-2026-108649

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the queryUserRolesById handler of the SystemApiController component. This vulnerability allows authenticated users to access the /sys/api/queryUserRolesById endpoint and retrieve the role codes of any user by p...

CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

CVE-2026-108648

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of the SystemApiController . The root cause is the lack of Shiro permission or role annotations , allowing any authenticated low-privileged user to exploit ...

CVE-2026-108648 JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...

CVE-2026-108647

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability within the SysCheckRuleController importExcel handler. This flaw allows low-privileged authenticated users to bypass the system:checkRule:add permission by uploading a crafted Excel workbook . Successful exp...

CVE-2026-108646

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController importExcel handler. This vulnerability allows any authenticated user to upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, includi...

CVE-2026-108647 JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and...

CVE-2026-108646 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the...

CVE-2026-108645

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the SysCategoryController component. This vulnerability allows any authenticated user to access the /sys/category/edit endpoint. By sending POST or PUT requests with a specific node ID, low-privileged attackers ...

CVE-2026-108645 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move...

CVE-2026-108644

JeecgBoot versions up to 3.9.5 are vulnerable to a missing authorization vulnerability in the SysCategoryController delete handler. This flaw allows any authenticated user to delete category dictionary nodes. Attackers with low privileges can identify target node IDs via the unguarded rootList an...

CVE-2026-108643

JeecgBoot through version 3.9.5 is vulnerable to a missing authorization flaw (CWE-862). This allows low-privileged authenticated users to perform unauthorized deletions of category dictionary entries via the DELETE /sys/category/deleteBatch endpoint. Attackers can identify target node IDs using ...

CVE-2026-108643 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to...

CVE-2026-108644 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete...