CVE-2026-108674 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the OpenAPI management module. Specifically, the missing authorization flaw resides in the queryById handler of the OpenApiController class. This architectural weakness allows any authenticated user with low-privileged roles to bypass intended security restrictions and retrieve sensitive configuration data associated with internal API definitions. The core technical issue stems from a lack of proper permission verification before executing the retrieval operation, effectively treating all authenticated sessions as having administrative or privileged access rights for this specific endpoint regardless of their actual role assignments.
From an operational perspective, the exploitation of this vulnerability enables attackers to extract detailed metadata about the application's internal API structure. By issuing a GET request to /openapi/queryById with a valid entry identifier, adversaries can obtain critical information including internal origin URLs, virtual path mappings, IP whitelist configurations, and templates for headers and parameters. This data disclosure is particularly dangerous because it provides a comprehensive map of the backend services exposed by the application. The exposure of internal origin URLs reveals how external requests are routed to internal microservices or servers, potentially exposing infrastructure topology that should remain hidden from standard users.
The revelation of IP whitelists poses a significant risk as it allows attackers to identify which network addresses are trusted and exempted from certain security checks such as CAPTCHA challenges or rate limiting. Armed with this knowledge, an attacker can spoof source IPs to bypass these protective measures during subsequent attacks against the application. Furthermore, access to header and parameter templates provides insight into expected request formats, authentication schemes, and data validation rules used by the backend services. This information significantly lowers the barrier for crafting sophisticated injection attacks or manipulating API calls in ways that might evade existing security controls designed based on assumed standard usage patterns.
This vulnerability aligns with CWE-285 Improper Authorization, as it involves a failure to enforce proper access control policies before granting access to sensitive resources. In terms of offensive cybersecurity frameworks, this activity corresponds to ATT&CK technique T1078 Valid Accounts and potentially contributes to reconnaissance efforts under T1592 Gather Victim Host Information or T1608 Install Defacement Tool if the retrieved data is used for further exploitation leading to system compromise. The ability to enumerate API endpoints and their configurations facilitates deeper penetration testing activities by allowing attackers to identify additional attack surfaces that may not be directly accessible through standard user interfaces but are exposed via internal APIs.
Mitigation strategies must focus on implementing robust role-based access control checks within the OpenApiController queryById method. Developers should ensure that only users with explicit openapi management permissions can execute queries against this endpoint, verifying these privileges before any data retrieval occurs. Additionally, it is advisable to implement strict input validation and least privilege principles across all API controllers to prevent similar authorization bypasses in other parts of the application. Regular security audits focusing on access control logic are essential to detect such misconfigurations early. For organizations unable to immediately patch their systems, network-level controls such as Web Application Firewalls can be configured to restrict access to /openapi/queryById based on user roles or IP addresses until a permanent fix is deployed.