CVE-2026-108866 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the queryUserAuths handler, which is designed to retrieve authentication and authorization data for user accounts. The core technical deficiency lies in the absence of proper validation on the userId parameter supplied by the client application. Instead of verifying that the requesting authenticated user has administrative privileges or owns the target account, the backend logic blindly processes the provided identifier. This allows any logged-in user, regardless of their privilege level, to manipulate this input and query permission sets belonging to other system entities.
From an operational perspective, this vulnerability enables a low-privileged attacker to perform unauthorized information disclosure. By supplying arbitrary userId values, attackers can systematically enumerate valid accounts within the system. More critically, they can retrieve the complete permission matrix for high-level administrative accounts. This exposure reveals which modules, features, and actions are available to administrators, effectively mapping out the attack surface of the application from an insider threat perspective or a compromised low-privilege account scenario. The ability to identify administrator accounts based on their extensive permission sets allows attackers to prioritize targets for further exploitation attempts, such as privilege escalation attacks against those specific high-value accounts.
This behavior aligns with several MITRE ATT&CK techniques related to Discovery and Collection. Specifically, it facilitates Account Enumeration (T1087) by allowing the identification of valid user IDs and their associated roles. Furthermore, accessing detailed permission structures contributes to Permission Denial Evasion or Access Token Manipulation contexts where understanding system boundaries is a precursor to lateral movement or privilege escalation. The lack of server-side authorization checks means that even if frontend controls restrict access visually, the underlying API remains vulnerable to direct manipulation via HTTP requests, bypassing any client-side security measures entirely.
To mitigate this vulnerability, immediate patching to version 3.9.6 or later is required as it addresses these access control flaws. In environments where upgrading is not immediately feasible, a compensating control involves implementing strict server-side authorization checks within the queryUserAuths handler. This includes verifying that the authenticated session's user ID matches the requested userId parameter for non-administrative users, and ensuring that only users with explicit administrative roles can query arbitrary accounts. Additionally, input validation should be enforced to ensure that provided identifiers correspond strictly to existing records without exposing excessive metadata about unrelated entities. Regular security audits focusing on object-level access control patterns are recommended to prevent similar issues in other handlers within the framework.