PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9373 JeecgBoot CVE debrief

A vulnerability in JeecgBoot 3.9.1 affects the OpenAPI Endpoint at /openapi/call/, where improper authentication controls allow remote attackers to bypass authentication. The attack requires high complexity and is assessed as difficult to exploit. The vendor was contacted prior to disclosure but did not respond. The vulnerability was published on 2026-05-24 and last modified on 2026-05-26.

Vendor
JeecgBoot
Product
JeecgBoot 3.9.1
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-07-23
Advisory published
2026-05-24
Advisory updated
2026-07-23

Who should care

Organizations running JeecgBoot 3.9.1 with exposed OpenAPI endpoints; security teams responsible for API authentication and access control; developers using JeecgBoot framework for enterprise applications.

Technical summary

CVE-2026-9373 is an improper authentication vulnerability (CWE-287) in JeecgBoot 3.9.1 affecting the /openapi/call/ endpoint. The vulnerability allows remote attackers to bypass authentication controls, though exploitation requires high complexity. The attack vector is network-based with no privileges required and no user interaction needed. The vulnerability has a CVSS 4.0 base score of 6.3 (MEDIUM severity) with low integrity impact. The vendor did not respond to early disclosure attempts.

Defensive priority

medium

Recommended defensive actions

  • Review and restrict access to the /openapi/call/ endpoint in JeecgBoot 3.9.1 deployments
  • Implement additional authentication layers or API gateway controls for OpenAPI endpoints
  • Monitor for unauthorized access attempts to OpenAPI endpoints
  • Consider upgrading to a patched version when available from the vendor
  • Apply network segmentation to limit exposure of OpenAPI endpoints to untrusted networks

Evidence notes

The vulnerability is classified as CWE-287 (Improper Authentication). CVSS 4.0 vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The vulnerability status in NVD is 'Deferred'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9373 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9373

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9373 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9373

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.