CVE-2026-108651 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the SystemApiController component, targeting the getRolesByUserId handler which is designed to retrieve role assignments for specific user accounts. The core technical deficiency lies in the absence of sufficient authorization checks on the input parameter userId provided by the client application. While the endpoint requires authentication, it does not verify whether the authenticated principal has the administrative privileges or ownership rights necessary to query the role data of other users. Consequently, any validly authenticated session, regardless of its privilege level, can interact with this API endpoint without restriction regarding which user's information is requested.
From an operational perspective, this missing authorization flaw enables low-privileged attackers to perform unauthorized enumeration of system roles and permissions. By supplying arbitrary userId values in GET requests directed at the /sys/api/getRolesByUserId path, an attacker can systematically iterate through potential user identifiers to map out the organization's internal structure. This capability allows for the identification of high-value targets such as administrator accounts or users with elevated privileges based on their assigned role codes. The exposure of these role assignments provides attackers with valuable intelligence that facilitates further exploitation attempts, including privilege escalation attacks where an attacker might attempt to exploit other vulnerabilities specific to administrative functions once they have confirmed which account holds those rights.
This vulnerability aligns closely with the MITRE ATT&CK technique T1078 Valid Accounts, as it relies on legitimate credentials to access sensitive information that should be restricted. Furthermore, it relates to data exposure risks where confidential system metadata is leaked through improper API design practices common in many enterprise web applications. The impact extends beyond simple role enumeration; by understanding the permission landscape of a target organization, attackers can tailor their subsequent attacks to bypass security controls more effectively or focus on specific administrative interfaces that are known to be associated with certain roles.
To mitigate this vulnerability, developers must implement strict authorization checks within the getRolesByUserId handler. The system should verify that the authenticated user is either an administrator with explicit permission to view all users' roles or is requesting data for their own userId only. Implementing role-based access control (RBAC) policies at the API level ensures that sensitive operations are restricted to authorized personnel. Additionally, adopting a principle of least privilege in API design and conducting regular security code reviews can prevent similar authorization flaws from being introduced into other endpoints. Patching to version 3.9.6 or later is recommended as it addresses these access control deficiencies by enforcing proper validation on user identity parameters before processing role retrieval requests.