CVE-2026-108654 jeecgboot CVE debrief

Who should care

Defenders responsible for JeecgBoot deployments, particularly those with low-privileged user accounts, should assess exposure and implement compensating controls to prevent unauthorized access to object storage file records.

Why it matters

CVE-2026-108654 is a missing authorization vulnerability in JeecgBoot that allows low-privileged authenticated users to read object storage file records. Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized access.

• Defenders need to verify exposure and implement compensating controls to prevent unauthorized access to object storage file records.
• Low-privileged authenticated users may be able to obtain original file names and direct storage URLs of files uploaded by other users.
• Remediation priority is medium, as the vulnerability has a CVSS score of 5.3 and is publicly known.

Technical summary

The OssFileController queryById handler in JeecgBoot through 3.9.5 does not properly authorize requests, allowing low-privileged authenticated users to read object storage file records by requesting GET /sys/oss/file/queryById with a known record id. The vulnerability has a CVSS score of 5.3 and is publicly known. Defenders should prioritize verifying exposure and implementing compensating controls to prevent unauthorized access to object storage file records. The CVE record and NVD entry provide details on the vulnerability, but vendor remediation and affected scope require verification.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls.

Recommended defensive actions

• Verify exposure by checking for vulnerable JeecgBoot versions and OssFileController queryById handler usage.
• Implement compensating controls, such as restricting access to object storage file records.
• Monitor for potential unauthorized access to file records.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor remediation and affected scope require verification. The vulnerability has a CVSS score of 5.3 and is publicly known. Defenders need to verify exposure and implement compensating controls to prevent unauthorized access to file records. Low-privileged authenticated users may be able to obtain original file names and direct storage URLs of files uploaded by other users. Remediation priority is medium.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.