CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

PT-2026-109910

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read the role codes of any user due to missing authorization in the queryUserRolesById handler of the SystemApiController. Low-privileged attackers can exploit this by sendi...