CVE-2026-108650

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the getUserPermissionSet handler of the SystemApiController component. An authenticated, low-privileged attacker can exploit this by supplying an arbitrary userId to the GET /sys/api/getUserPermissionSet endpoint. ...