CVE-2026-108627 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the SysRoleController component. Specifically, the loadDatarule handler fails to enforce proper authorization checks before processing requests related to data rules associated with system roles. This architectural flaw allows any authenticated user, regardless of their privilege level or administrative status, to interact directly with endpoints designed for privileged operations. The core issue lies in the absence of a verification step that ensures the requesting user possesses the necessary permissions to view specific role configurations. In secure application design, data access should be strictly bound to the identity and rights of the caller, ensuring that sensitive configuration details remain isolated from unauthorized entities.
Technically, this flaw manifests as an insecure direct object reference combined with broken access control. Attackers can exploit this by crafting HTTP GET requests targeting the endpoint /sys/role/datarule/{permissionId}/{roleId}. By manipulating the permissionId and roleId parameters in the URL path, a low-privileged user can enumerate and retrieve detailed information about data rules for any role within the system. The returned data includes sensitive operational details such as rule names, associated database columns, conditional logic definitions, specific values assigned to those conditions, and bound rule identifiers. This level of granularity provides attackers with deep insight into how the application enforces security policies at the data layer, effectively bypassing intended restrictions on who can view or modify these rules.
The operational impact of this vulnerability is significant due to the nature of the exposed information. Data rules often dictate which users can see specific records in a database based on criteria such as department, location, or user role. By accessing these rule definitions, an attacker gains visibility into the organization's data segmentation strategy and security logic. This knowledge facilitates further attacks, including privilege escalation attempts where the attacker might modify their own permissions to gain higher access levels, or targeted information disclosure where they identify high-value targets by understanding which roles have access to sensitive datasets. Furthermore, exposure of rule conditions may reveal internal business logic or database schema details that can be leveraged for subsequent injection attacks or system manipulation.
This vulnerability aligns with CWE-285 Improper Authorization and CWE-639 Injection into Critical Data Structures if the exposed data is subsequently used in unsafe ways. In terms of offensive security frameworks, it corresponds to ATT&CK technique T1078 Valid Accounts, as exploitation requires valid authentication credentials but abuses them for unauthorized access, and potentially T1530 Data from Cloud Storage Objects or internal databases depending on how the rule data is stored and accessed. The lack of server-side validation means that client-side controls are insufficient to prevent this information leak, highlighting a common pitfall in web application development where frontend permissions do not match backend enforcement logic.
To mitigate this vulnerability, immediate patching to version 3.9.6 or later is required as it addresses the authorization checks within the SysRoleController. For systems that cannot be immediately updated, implementing an additional middleware layer or interceptor can enforce role-based access control on all requests targeting data rule endpoints. Administrators should ensure that only users with explicit administrative privileges for role management are permitted to invoke these handlers. Additionally, applying principle of least privilege across user accounts ensures that even if the vulnerability is exploited, the scope of damage is limited by restricting what low-privileged users can do with any retrieved information. Regular security audits and static code analysis tools should be employed to detect similar missing authorization patterns in other controllers within the application framework.