CVE-2026-108887

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysCommentController exportXls handler. This vulnerability allows any authenticated user to request the /sys/comment/exportXls endpoint to download every sys_comment row. Consequently, low-privilege...

EUVD-2026-97061

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...