EUVD-2026-96617

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108678

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108651

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108649

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108651

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108649

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw within the queryUserRolesById handler of the SystemApiController component. This vulnerability allows authenticated users to access the /sys/api/queryUserRolesById endpoint and retrieve the role codes of any user by p...

CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...

PT-2026-109939

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

PT-2026-109910

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read the role codes of any user due to missing authorization in the queryUserRolesById handler of the SystemApiController. Low-privileged attackers can exploit this by sendi...