CVE-2026-108674 jeecgboot CVE debrief

Who should care

Defenders and administrators of systems using JeecgBoot, especially those with low-privileged user access to the OpenApiController, should assess their exposure and implement necessary mitigations.

Why it matters

CVE-2026-108674 is a missing authorization vulnerability in JeecgBoot's OpenApiController that allows low-privileged users to access OpenAPI definitions. Defenders should verify and restrict access to these definitions, especially in environments with low-privileged user access. The vulnerability's impact on system security posture requires immediate attention and mitigation.

• Potential exposure of internal system information
• Risk of unauthorized access to sensitive OpenAPI definitions
• Need for verification of OpenAPI definition access controls
• Possible impact on system security posture due to missing authorization

Technical summary

The vulnerability exists in the OpenApiController queryById handler of JeecgBoot through 3.9.5. It allows low-privileged authenticated users to read OpenAPI definitions without the required openapi permissions by making a GET request to /openapi/queryById with an entry id. This could potentially expose internal origin URLs, virtual paths, IP whitelists, and header and parameter templates. Affected product deployments should be reviewed for exposure, and defenders should prioritize verifying and restricting access to OpenAPI definitions, especially in environments where low-privileged users have access to the OpenApiController.

Defensive priority

Defenders should prioritize verifying and restricting access to OpenAPI definitions, especially in environments where low-privileged users have access to the OpenApiController.

Recommended defensive actions

• Verify and restrict access to OpenAPI definitions
• Implement proper authorization checks for OpenApiController
• Monitor for suspicious activity related to OpenAPI queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, additional information about affected versions, exploitation, and remediation may require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.