CVE-2026-108649

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

CVE-2026-108650

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...

CVE-2026-108648

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...

CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108679

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization vulnerability in the SystemApiController component, specifically within the sendBusAnnouncement handler. This flaw allows any authenticated user to bypass permission checks by sending a POST request to /sys/api/sendBusA...

CVE-2026-108679

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108678

The JeecgBoot framework (versions through 3.9.5 ) contains a missing authorization vulnerability in the queryUserRoles handler of the SystemApiController . This flaw allows authenticated users to perform GET requests to the /sys/api/queryUserRoles endpoint using an arbitrary username. Consequentl...

CVE-2026-108678

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108652

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108652

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController updateAvatar handler. This security weakness allows any authenticated user to modify the avatars of other users, including administrators. A low-privileged attacker can exploit this by sendi...

CVE-2026-108651

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108650 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...