EUVD-2026-96590

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108651

The JeecgBoot framework, version 3.9.5 and below, is vulnerable to a missing authorization flaw in the getRolesByUserId handler of the SystemApiController . This vulnerability allows authenticated users to bypass authorization checks by supplying arbitrary userId values via a GET request to /sys/...