CVE-2026-108866

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

EUVD-2026-97040

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

CVE-2026-108866

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the /sys/api/queryUserAuths handler. This vulnerability allows authenticated, low-privileged users to provide an arbitrary userId parameter to retrieve the complete permission sets of other accounts. Consequently, ...

CVE-2026-108866

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

PT-2026-110188

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read permissions for any account due to missing authorization in the queryUserAuths handler. Low-privileged attackers can provide an arbitrary userId parameter to retrieve t...

CVE-2026-108866: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...