CVE-2026-108886 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in JeecgBoot versions up to 3.9.5 represents a critical failure in access control mechanisms within the user management subsystem. Specifically, the flaw resides in the SysUserController queryChildrenByUsername handler, which is designed to retrieve information about subordinate users or related account records based on a provided username. The core technical deficiency lies in the absence of proper authorization checks when processing requests that include arbitrary userId parameters. While the application correctly authenticates the user making the request, it fails to verify whether this authenticated user has the administrative privileges required to access data belonging to other specific individuals. This oversight allows any logged-in account, regardless of its role or permission level within the system hierarchy, to bypass intended restrictions and query sensitive personal information associated with arbitrary user identifiers.
From a technical perspective, this issue is classified as an Insecure Direct Object Reference (IDOR), which corresponds to CWE-639 in the Common Weakness Enumeration standard. The vulnerability exploits the predictable or guessable nature of userId values within the application's backend logic. By manipulating the input parameter that specifies the target user ID, attackers can iterate through valid identifiers to harvest a comprehensive dataset of employee information. This includes not only basic contact details such as names, email addresses, and phone numbers but also more sensitive organizational data like employee numbers, department assignments, and lists of staff members under specific managers. The lack of server-side validation ensures that the application trusts client-supplied input without verifying the requester's entitlement to view the requested resource, a fundamental principle violation in secure software design as outlined by OWASP guidelines for access control failures.
The operational impact of this vulnerability is significant, particularly for organizations relying on JeecgBoot for internal human resources or employee directory management. The exposure of personally identifiable information (PII) can lead to severe privacy violations and potential regulatory non-compliance with standards such as GDPR or CCPA depending on the jurisdiction. Furthermore, the aggregated data provides attackers with valuable intelligence that facilitates further malicious activities. With detailed knowledge of organizational structure, departmental hierarchies, and contact details, threat actors can craft highly targeted phishing campaigns, social engineering attacks, or credential stuffing attempts against specific high-value targets within the organization. The ability to map out staff lists under particular managers also aids in identifying key personnel for more sophisticated supply chain or insider threat scenarios.
To mitigate this vulnerability, immediate action is required by upgrading JeecgBoot to a version later than 3.9.5 where these access control checks have been implemented. In the interim, if an upgrade is not immediately feasible, administrators should implement strict role-based access control (RBAC) policies at the application level or via reverse proxy configurations. It is essential to ensure that endpoints handling sensitive user data are restricted to users with explicit administrative roles rather than relying solely on authentication status. Additionally, implementing input validation and ensuring that userId parameters cannot be arbitrarily manipulated by unprivileged users will help prevent exploitation. Regular security audits focusing on access control logic and the implementation of principle of least privilege across all API handlers are recommended to maintain a robust security posture against similar IDOR attacks as categorized under MITRE ATT&CK technique T1078, specifically relating to valid accounts being used for unauthorized data access.