CVE-2026-108649 jeecgboot CVE debrief

Who should care

System administrators and security teams responsible for JeecgBoot installations, especially those with low-privileged user accounts, should assess exposure and prioritize mitigation to prevent potential role enumeration and unauthorized access.

Why it matters

CVE-2026-108649 is a medium-severity vulnerability in JeecgBoot that allows authenticated users to enumerate role assignments. Defenders should verify exposure, especially in systems with low-privileged accounts, and prioritize mitigation to prevent potential unauthorized access and privilege escalation.

• Role enumeration and potential privilege escalation.
• Unauthorized access to sensitive role information.
• Increased risk of targeted attacks using enumerated role assignments.
• Potential for lateral movement within compromised systems.

Technical summary

The queryUserRolesById handler in SystemApiController of JeecgBoot through 3.9.5 does not properly enforce authorization, allowing authenticated users to read role codes of any user by sending a crafted request to GET /sys/api/queryUserRolesById with a userId parameter. This vulnerability enables low-privileged attackers to enumerate role assignments and identify administrator accounts, potentially leading to privilege escalation or unauthorized access. Defenders should verify exposure, especially in systems with low-privileged accounts, and prioritize mitigation to prevent potential unauthorized access and privilege escalation.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where role enumeration could lead to privilege escalation or unauthorized access.

Recommended defensive actions

• Verify the version of JeecgBoot in use and check if it is vulnerable (3.9.5 or earlier).
• Restrict access to the /sys/api/queryUserRolesById endpoint to authorized users only.
• Implement additional monitoring to detect and respond to potential exploitation attempts.
• Consider upgrading to a version of JeecgBoot that addresses this vulnerability, if available.
• Review system configurations for potential exposure.
• Conduct a thorough review of role assignments and user privileges.
• Monitor for suspicious activity related to role enumeration.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in JeecgBoot through 3.9.5. The queryUserRolesById handler in SystemApiController does not properly enforce authorization, allowing authenticated users to read role codes of any user. However, the exact scope of affected systems and versions beyond 3.9.5 is not specified, requiring further verification and defensive review of system configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.