CVE-2026-108627 jeecgboot CVE debrief

Who should care

Defenders and administrators of systems using JeecgBoot, especially those with low-privileged users, should assess exposure and prioritize patching or mitigating the vulnerability.

Why it matters

CVE-2026-108627 is a missing authorization vulnerability in JeecgBoot that allows authenticated users to query role data rules. Defenders should prioritize verifying and patching vulnerable instances, especially in systems where low-privileged users have access to the affected endpoint.

• Potential unauthorized access to role data rules
• Possible exploitation by low-privileged attackers
• Need for verification of affected systems and versions
• Priority for patching or mitigating the vulnerability

Technical summary

The loadDatarule handler of SysRoleController in JeecgBoot through version 3.9.5 is vulnerable to missing authorization. This allows any authenticated user to query role data rules by requesting GET /sys/role/datarule/{permissionId}/{roleId}. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying and patching vulnerable JeecgBoot instances, especially in systems where low-privileged users have access to the affected endpoint. The affected product context indicates that low-privileged attackers can request role data rules, potentially leading to unauthorized access.

Defensive priority

Defenders should prioritize verifying and patching vulnerable JeecgBoot instances, especially in systems where low-privileged users have access to the affected endpoint.

Recommended defensive actions

• Verify and patch vulnerable JeecgBoot instances
• Restrict access to the affected endpoint
• Monitor for suspicious activity on the affected endpoint
• Perform an inventory of exposed assets
• Review compensating controls for exposed systems
• Plan for vendor-supported updates or mitigations through normal change control
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was discovered and reported by an unknown source. The CVE record and NVD entry provide details about the vulnerability, but there is limited information about the actual impact and affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.