EUVD-2026-96593

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108654

JeecgBoot versions up to and including 3.9.5 are affected by a missing authorization vulnerability in the OssFileController queryById handler. This flaw allows low-privileged authenticated users to access records belonging to other users by requesting GET /sys/oss/file/queryById with a known reco...