CVE-2026-108678 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the SystemApiController component, affecting the queryUserRoles handler which is designed to retrieve role assignments for specific users. The core technical deficiency lies in the absence of sufficient authorization checks that validate whether the requesting authenticated user has permission to access the data associated with other accounts. Consequently, any validly authenticated session can bypass intended restrictions and interact directly with this endpoint without being denied by the application logic.
From an operational perspective, this missing authorization allows low-privileged attackers to perform sensitive information enumeration against the target system. By sending GET requests to the /sys/api/queryUserRoles endpoint and supplying arbitrary usernames as parameters, an attacker can systematically retrieve role codes for any user within the organization. This capability effectively neutralizes the security boundary between standard users and administrative accounts, enabling adversaries to map out the internal hierarchy of privileges without requiring elevated credentials themselves.
The impact of this vulnerability extends beyond simple data leakage into active exploitation pathways that facilitate further attacks. By enumerating role assignments, attackers can accurately identify which user accounts possess administrator or high-privilege roles. This intelligence is instrumental in planning targeted privilege escalation attempts, such as brute-force attacks against identified admin accounts or crafting social engineering campaigns aimed at those specific individuals. The exposure of internal role structures also aids adversaries in understanding the system's security model, allowing them to tailor their attack vectors more effectively based on known administrative workflows and access patterns.
This behavior aligns with several tactics defined in the MITRE ATT&CK framework, particularly T1087 Account Discovery where attackers seek information about accounts stored within a target environment, and T1548 Abuse Elevation Control Mechanism which involves exploiting flaws to bypass or manipulate privilege controls. The vulnerability essentially serves as an initial foothold for lateral movement within the network by revealing high-value targets that would otherwise remain obscured from lower-level users.
Mitigation strategies must prioritize immediate patching of JeecgBoot to version 3.9.6 or later where this issue has been addressed. In addition to updating software, organizations should implement strict input validation and enforce principle of least privilege across all API endpoints. It is crucial that the queryUserRoles handler verifies not only authentication but also authorization, ensuring that a user can only request role information for their own account unless explicitly granted broader administrative rights through proper RBAC policies. Regular security audits focusing on access control logic in RESTful APIs are recommended to prevent similar misconfigurations from persisting in enterprise applications.