Vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Apache Software Foundation

Product

Shiro

CVSS

6.5

Exposure class

Identity

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108648 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling…

   CVSS 4.3 CVE-2026-108680
2. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any…

   CVSS 4.3 CVE-2026-108679
3. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated…

   CVSS 4.3 CVE-2026-108678
4. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users…

   CVSS 6.5 CVE-2026-108677
5. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows…

   CVSS 4.3 CVE-2026-108676
6. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108675
7. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108674
8. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated…

   CVSS 4.3 CVE-2026-108673
9. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows…

   CVSS 4.3 CVE-2026-108672
10. 8
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because…

    CVSS 6.5 CVE-2026-108671 Anthropic
11. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any…

    CVSS 4.3 CVE-2026-108670
12. 15
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro…

    CVSS 4.3 CVE-2026-108669 Apache Software Foundation
13. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any…

    CVSS 5.4 CVE-2026-108668
14. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt…

    CVSS 4.3 CVE-2026-108667
15. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any…

    CVSS 5.4 CVE-2026-108666
16. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user…

    CVSS 4.3 CVE-2026-108665
17. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…

    CVSS 4.3 CVE-2026-108664
18. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated…

    CVSS 4.3 CVE-2026-108663
19. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant…

    CVSS 5.4 CVE-2026-108662
20. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…

    CVSS 6.5 CVE-2026-108661