CVE-2026-108891 in JeecgBoot
Summary
by MITRE • 10/11/2026
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The identified security flaw resides within the JeecgBoot framework version 3.9.5, specifically affecting the SysUserController component responsible for managing system user accounts. The vulnerability is classified as a broken access control issue where the getUserDetailByUserId handler fails to enforce proper authorization checks on the userId parameter provided by the client application. In a secure implementation of such functionality, the server must verify that the authenticated principal requesting the data has administrative privileges or owns the specific resource being accessed. However, in this instance, the backend logic accepts any valid user ID submitted via HTTP requests without validating whether the requester is authorized to view those particular details. This architectural oversight effectively bypasses role-based access control mechanisms intended to restrict sensitive personal information retrieval to administrators only.
From a technical perspective, the exploitation of this vulnerability requires an attacker who has already obtained valid authentication credentials for any standard user account within the JeecgBoot environment. Once authenticated, the attacker can craft HTTP requests targeting the vulnerable endpoint and inject arbitrary userId values corresponding to other users in the system. The server processes these requests without checking if the current session owner matches the target userId or possesses elevated privileges necessary for such queries. Consequently, the application returns comprehensive user profile data associated with the specified identifier. This includes sensitive personally identifiable information such as real names, usernames, email addresses, phone numbers, birthdays, employee identification numbers, departmental hierarchies, and job positions. The lack of server-side validation allows low-privileged users to enumerate internal staff details simply by iterating through sequential or known user identifiers.
The operational impact of this vulnerability is significant due to the nature of the data exposed. While individual pieces of information like a username might seem benign in isolation, their aggregation creates substantial risks for social engineering attacks and targeted phishing campaigns. Attackers can use real names, job titles, and department structures to craft highly convincing spear-phishing messages that appear legitimate to victims. Furthermore, exposure of email addresses and phone numbers facilitates broader spamming or credential stuffing attempts if those contact details are reused across other platforms. The disclosure of employee numbers and internal organizational charts also aids adversaries in mapping the corporate structure, which is critical for planning more advanced persistent threats against specific high-value targets within the organization. This scenario aligns directly with CWE-284 Improper Access Control and represents a common pattern found in ATT&CK technique T1078 Valid Accounts when used to gather reconnaissance data prior to further exploitation phases such as credential dumping or lateral movement preparation.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict authorization checks within the getUserDetailByUserId method. The system must verify that the authenticated user requesting the information is either an administrator with explicit permission to view all users or the specific owner of the account being queried. If cross-user access is required for legitimate business purposes, it should be gated behind additional administrative approval workflows rather than relying solely on basic authentication. Developers should also adopt a principle of least privilege by ensuring that endpoints handling sensitive personal data are restricted to roles with appropriate clearance levels. Additionally, implementing input validation and logging mechanisms can help detect abnormal patterns of user detail requests that may indicate automated enumeration attempts. Regular security audits and penetration testing focused on access control logic are recommended to identify similar flaws in other parts of the application before they can be exploited by malicious actors seeking to compromise organizational confidentiality.