CVE-2026-108655 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the application's scheduling subsystem. Specifically, the flaw resides in the queryById handler of the QuartzJobController component. This endpoint is designed to retrieve detailed information about specific scheduled jobs by accepting a job identifier as input. The core technical deficiency lies in the absence of proper authorization checks before processing this request. While the system correctly authenticates users and assigns them roles such as low-privileged authenticated user, it fails to verify whether these users possess the necessary permissions to access administrative data structures. Consequently, any validly authenticated account, regardless of its privilege level or role assignment within the application hierarchy, can interact with this endpoint without restriction.
From a technical perspective, the exploitation vector involves sending an HTTP GET request to the /sys/quartzJob/queryById path while supplying a target job ID in the query parameters or body. Because the server does not validate if the requesting user has administrative rights or ownership of the specific job record, it proceeds to fetch and return the full dataset associated with that identifier. This behavior violates the principle of least privilege and demonstrates an insecure direct object reference pattern where access control is tied solely to authentication rather than authorization. The lack of role-based access control checks at this specific controller method allows for unauthorized data exfiltration from a module typically reserved for system administrators who manage background tasks and automated processes.
The operational impact of this vulnerability is significant due to the sensitive nature of the exposed information. Scheduled job records contain highly valuable intelligence about the application's internal architecture and operational logic. The returned data includes class names, which reveal specific Java classes used by the backend, potentially aiding in further targeted attacks against known vulnerabilities within those libraries or custom code. Cron expressions expose the timing and frequency of automated tasks, providing attackers with insights into system maintenance windows, backup schedules, or periodic processing cycles that could be exploited for denial-of-service conditions or to time other attack vectors effectively. Furthermore, job parameters often contain configuration details, database connection strings, API keys, or internal URLs, which can lead to further compromise if leaked. The status field provides visibility into the current state of these jobs, allowing attackers to monitor system activity and adjust their strategies accordingly.
This vulnerability aligns with several well-known industry standards for security classification. It is primarily categorized under CWE-862 Missing Authorization, as the application fails to enforce proper access controls on a protected resource. Additionally, it fits the profile of CWE-639 Insecure Direct Object Reference, where an identifier provided by the user is used directly to access an object without sufficient verification that the requester has permission to do so. From an offensive security perspective, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts and specifically relates to data exfiltration methods such as T1530 Data from Information Repositories or T1005 Data from Local System, depending on the scope of access gained through these job details.
To mitigate this vulnerability, immediate action is required by upgrading JeecgBoot to a version later than 3.9.5 where the issue has been addressed in subsequent releases. For organizations unable to upgrade immediately due to compatibility constraints or deployment cycles, implementing compensating controls at the network perimeter can provide temporary relief. Deploying a Web Application Firewall with rules that detect and block unauthorized access attempts to administrative endpoints like /sys/quartzJob/queryById by non-admin users may help reduce exposure. However, this is not a substitute for fixing the root cause within the application code. Developers must review all controller methods handling sensitive data to ensure they implement robust authorization checks using frameworks such as Spring Security or Shiro, verifying that only users with specific administrative roles are granted access to job management features. Regular security audits and penetration testing focusing on broken object level permissions should be conducted to identify similar flaws across the application surface area before further exploitation occurs in production environments.