PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9373 JeecgBoot CVE debrief

A vulnerability in JeecgBoot 3.9.1 affects the OpenAPI Endpoint at /openapi/call/, where improper authentication controls allow remote attackers to bypass authentication. The attack requires high complexity and is assessed as difficult to exploit. The vendor was contacted prior to disclosure but did not respond. The vulnerability was published on 2026-05-24 and last modified on 2026-05-26.

Vendor
JeecgBoot
Product
JeecgBoot 3.9.1
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-05-26
Advisory published
2026-05-24
Advisory updated
2026-05-26

Who should care

Organizations running JeecgBoot 3.9.1 with exposed OpenAPI endpoints; security teams responsible for API authentication and access control; developers using JeecgBoot framework for enterprise applications.

Technical summary

CVE-2026-9373 is an improper authentication vulnerability (CWE-287) in JeecgBoot 3.9.1 affecting the /openapi/call/ endpoint. The vulnerability allows remote attackers to bypass authentication controls, though exploitation requires high complexity. The attack vector is network-based with no privileges required and no user interaction needed. The vulnerability has a CVSS 4.0 base score of 6.3 (MEDIUM severity) with low integrity impact. The vendor did not respond to early disclosure attempts.

Defensive priority

medium

Recommended defensive actions

  • Review and restrict access to the /openapi/call/ endpoint in JeecgBoot 3.9.1 deployments
  • Implement additional authentication layers or API gateway controls for OpenAPI endpoints
  • Monitor for unauthorized access attempts to OpenAPI endpoints
  • Consider upgrading to a patched version when available from the vendor
  • Apply network segmentation to limit exposure of OpenAPI endpoints to untrusted networks

Evidence notes

The vulnerability is classified as CWE-287 (Improper Authentication). CVSS 4.0 vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The vulnerability status in NVD is 'Deferred'.

Official resources

The vendor was contacted early about this disclosure but did not respond in any way.