CVE-2026-108886

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController queryChildrenByUsername handler. This vulnerability allows any authenticated user to retrieve account records of other users by supplying arbitrary userId values. Impacted data includes names,...

EUVD-2026-97060

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...

PT-2026-51690

Name of the Vulnerable Software and Affected Versions Devs Accounting – Simple Accounting and Invoicing Solution versions prior to 1.2.1 Description A missing capability check in the delete single account function allows unauthorized modification or deletion of data. The REST route...