CVE-2026-108651

The JeecgBoot framework, version 3.9.5 and below, is vulnerable to a missing authorization flaw in the getRolesByUserId handler of the SystemApiController . This vulnerability allows authenticated users to bypass authorization checks by supplying arbitrary userId values via a GET request to /sys/...