CVE-2026-11458 in JeeWMS
Summary
by MITRE • 06/07/2026
A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/07/2026
The vulnerability identified in erzhongxmu JeeWMS represents a critical information disclosure weakness within the Boot Actuator Endpoint component that affects versions up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69. This flaw resides in the processing of the /base-boot/actuator endpoint which serves as a critical management interface for spring boot applications. The vulnerability allows remote attackers to execute manipulations that can result in unauthorized access to sensitive system information, potentially exposing system configurations, environment variables, and other confidential data that should remain protected within the application's operational boundaries.
The technical nature of this vulnerability stems from inadequate input validation and access control mechanisms within the actuator endpoint implementation. According to CWE classification, this represents a weakness in the security model where insufficient access restrictions allow unauthorized information disclosure. The attack vector is particularly concerning as it operates remotely without requiring authentication, making it highly exploitable in networked environments. The public availability of exploit code significantly increases the risk profile, as malicious actors can readily leverage this vulnerability without requiring advanced technical skills or specialized tools.
The operational impact of this vulnerability extends beyond simple information disclosure, as the exposed data could enable attackers to conduct more sophisticated attacks such as privilege escalation, system compromise, or targeted exploitation of other vulnerabilities within the application stack. The rolling release model employed by this product complicates remediation efforts since version information is not readily available, making it difficult for organizations to determine whether their installations are affected or to track the progression of security updates. This lack of clear versioning information also hampers coordinated vulnerability management and patch deployment processes that are critical for maintaining security posture.
Security practitioners should consider implementing network segmentation and access controls to limit exposure of the actuator endpoint to trusted networks only. The absence of vendor response following early disclosure attempts creates additional risk as there is no official patch or mitigation guidance available from the software vendor. Organizations should monitor for the availability of third-party patches or consider implementing temporary workarounds such as disabling the actuator endpoint or implementing reverse proxy rules to restrict access. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access and reconnaissance, potentially enabling adversaries to gather intelligence for subsequent phases of attack. The combination of remote exploitability, public availability of exploitation tools, and lack of vendor response creates a particularly dangerous security landscape that requires immediate attention from affected organizations.