CVE-2026-108887

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysCommentController exportXls handler. This vulnerability allows any authenticated user to request the /sys/comment/exportXls endpoint to download every sys_comment row. Consequently, low-privilege...