113634 matches found
CVE-2026-108891
JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController getUserDetailByUserId handler. This vulnerability allows any authenticated user to access the personal details of other users by providing arbitrary userId values. Exploitation can...
CVE-2026-108891 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, pho...
CVE-2026-108888
JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability within the SysDepartRoleController exportXls handler. This flaw allows any authenticated user to access the /sys/sysDepartRole/exportXls endpoint. Attackers with the default minimal role can exploit this to dow...
EUVD-2026-97062
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...
CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...
CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...
CVE-2026-108886
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController queryChildrenByUsername handler. This vulnerability allows any authenticated user to retrieve account records of other users by supplying arbitrary userId values. Impacted data includes names,...
CVE-2026-108887
JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysCommentController exportXls handler. This vulnerability allows any authenticated user to request the /sys/comment/exportXls endpoint to download every sys_comment row. Consequently, low-privilege...
EUVD-2026-97061
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...
CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...
CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...
CVE-2026-108887 JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...
EUVD-2026-97060
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...
CVE-2026-108887 JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...
CVE-2026-108885 JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any syssms row, erasing records of sent...
CVE-2026-108885
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageController delete handler. This vulnerability allows low-privileged authenticated users to perform unauthorized deletions of message records by sending DELETE requests with arbitrary id values. Specif...
EUVD-2026-97059
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any syssms row, erasing records of sent...
CVE-2026-108885 JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any syssms row, erasing records of sent...
CVE-2026-108884
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysMessageTemplateController delete handler. This vulnerability allows any authenticated user to delete message templates. An attacker with low privileges can retrieve valid template IDs from an unguarded list ...
CVE-2026-108884 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...