CVE-2026-108887 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_comment row, including comment text and user ids on records they cannot access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5, specifically affecting the SysCommentController component. This vulnerability is classified as a broken access control issue where the application fails to enforce proper authorization checks before processing data export requests. The core technical deficiency lies in the exportXls handler method, which processes HTTP GET or POST requests directed at the /sys/comment/exportXls endpoint without verifying whether the requesting user possesses sufficient privileges to view the specific records being exported. In a properly secured implementation, such an operation would require the system to cross-reference the requested data against the current session's permissions and role-based access control lists before generating the file. Instead, the handler blindly aggregates all rows from the sys_comment database table regardless of the user's identity or assigned roles, thereby bypassing standard row-level security mechanisms that are typically enforced during normal API interactions for viewing individual comments.
This architectural oversight allows any authenticated user to perform a bulk data extraction operation that should be restricted to administrators or users with specific audit privileges. By simply crafting a request to the vulnerable endpoint, an attacker can download a comprehensive Excel file containing every comment stored in the system. This includes sensitive information such as the full text of comments and associated user identifiers for records that the attacker is not authorized to view individually. The impact extends beyond simple data leakage; it represents a significant violation of confidentiality principles because it enables low-privileged attackers to bypass granular access controls through an administrative or bulk-processing function. The ability to export all comment data facilitates further reconnaissance, allowing adversaries to map user relationships, identify high-value targets based on their comments, and potentially gather information for social engineering attacks or credential stuffing campaigns using the exposed user IDs.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves an application failing to restrict access to resources based on user privileges. It also correlates with MITRE ATT&CK technique T1005 Data from Local System Retrieval, specifically the subtechnique of data staged for exfiltration via file export functions. The vulnerability highlights a common pitfall in web development where developers assume that security checks applied to standard read operations are automatically inherited by bulk processing or administrative utility endpoints without explicit implementation. This assumption leads to inconsistent enforcement of security policies across different parts of the application logic, creating exploitable gaps for authenticated attackers who have already bypassed initial authentication barriers.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict authorization checks within the exportXls handler in SysCommentController. Developers must ensure that any bulk data retrieval operation verifies not only user authentication but also explicit administrative privileges or specific role-based permissions required for exporting sensitive comment data. Additionally, input validation and rate limiting should be applied to prevent abuse of this endpoint by automated tools. For organizations unable to patch immediately due to dependency constraints, network-level controls such as Web Application Firewalls can be configured to restrict access to the /sys/comment/exportXls path based on user roles or IP addresses until a permanent fix is deployed. Regular security code reviews and static application security testing should also be integrated into the development lifecycle to detect similar missing authorization patterns in other controllers before they reach production environments.