CVE-2026-108655 jeecgboot CVE debrief

Who should care

Defenders and administrators of systems using JeecgBoot, especially those with low-privileged user access to the affected interface, should assess exposure and implement mitigations.

Why it matters

CVE-2026-108655 is a missing authorization vulnerability in JeecgBoot through 3.9.5. It allows low-privileged authenticated users to read scheduled job records. Defenders should verify and mitigate this vulnerability, especially in systems where low-privileged users have access to the affected interface. The scope of affected versions and potential impact requires further verification from official sources.

• Potential unauthorized access to sensitive job records.
• Possible exposure of job class names, cron expressions, and job parameters.
• Need for verification of affected versions and scope.
• Priority for implementing compensating controls and monitoring.

Technical summary

The QuartzJobController in JeecgBoot through 3.9.5 has a missing authorization vulnerability in the queryById handler. This allows low-privileged authenticated users to read scheduled job records by requesting GET /sys/quartzJob/queryById with a job id, thereby retrieving job class names, cron expressions, job parameters, and status typically reserved for administrators. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privileged users have access to the affected interface.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where low-privileged users have access to the affected interface.

Recommended defensive actions

• Verify the version of JeecgBoot in use and assess exposure.
• Restrict access to the QuartzJobController queryById handler.
• Monitor for unauthorized access attempts to scheduled job records.
• Implement additional authentication checks for low-privileged users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the scope of affected versions and potential impact requires further verification from official sources. Defenders should verify the version of JeecgBoot in use, assess exposure, and implement mitigations. The QuartzJobController queryById handler allows low-privileged authenticated users to read scheduled job records, retrieving job class names, cron expressions, job parameters, and status typically reserved for administrators.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.