CVE-2026-108653 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the OpenAPI management subsystem. Specifically, the queryPageList handler associated with the OpenApiController lacks sufficient authorization checks to restrict access based on user privilege levels. This architectural flaw allows any authenticated user, regardless of their assigned role or permission set, to interact with endpoints designed exclusively for administrative oversight and configuration. The core technical issue lies in the absence of a mandatory check that verifies whether the requesting entity possesses the necessary privileges to view sensitive system metadata before processing the request.
By exploiting this missing authorization flaw, an attacker can successfully execute GET requests against the /openapi/list endpoint without encountering access denied errors or authentication failures beyond standard login requirements. This capability enables low-privileged users to enumerate and retrieve detailed information about registered OpenAPI definitions within the application environment. The data exposed through this vector includes virtual paths that define how external systems interact with internal services, internal origin URLs which reveal backend infrastructure topology, IP whitelists that indicate trusted network sources for API access, and header or parameter templates used in automated integrations.
The operational impact of this vulnerability is significant as it facilitates a comprehensive reconnaissance phase against the target application ecosystem. The disclosure of virtual paths and internal origin URLs allows attackers to map out the underlying service architecture, identifying potential entry points for further exploitation such as injection attacks or unauthorized data access through other exposed endpoints. Knowledge of IP whitelists enables adversaries to craft spoofed requests that may bypass network-level security controls if those controls rely solely on source address verification without additional authentication checks. Furthermore, exposure of header and parameter templates can aid in crafting precise malicious payloads for subsequent attack vectors like SQL injection or cross-site scripting by revealing expected input formats and validation logic.
This vulnerability aligns with CWE-285 Improper Authorization, as the application fails to enforce proper access controls when granting user requests against protected resources. From a tactical perspective, this behavior corresponds to ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to sensitive information, and potentially supports reconnaissance activities categorized under T1592 Gather Victim Host Information by mapping out the application's API structure and network dependencies. The exposure of internal configuration details significantly lowers the barrier for subsequent exploitation attempts against the broader system infrastructure.
Mitigation strategies must prioritize immediate patching to version 3.9.6 or later where this authorization check has been corrected. In environments where upgrading is not immediately feasible, administrators should implement a web application firewall rule set that restricts access to the /openapi/list endpoint exclusively to users with administrative roles based on session attributes or token claims. Additionally, it is advisable to audit other endpoints within the OpenApiController for similar missing authorization checks and apply consistent role-based access control policies across all management interfaces. Regular security assessments focusing on broken object level permissions are recommended to identify and remediate analogous flaws in future development cycles.