Vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

4.3

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-108678 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling…

   CVSS 4.3 CVE-2026-108680
2. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any…

   CVSS 4.3 CVE-2026-108679
3. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users…

   CVSS 6.5 CVE-2026-108677
4. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows…

   CVSS 4.3 CVE-2026-108676
5. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108675
6. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged…

   CVSS 4.3 CVE-2026-108674
7. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated…

   CVSS 4.3 CVE-2026-108673
8. 3
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows…

   CVSS 4.3 CVE-2026-108672
9. 8
   CVE NVD 21d ago

   JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because…

   CVSS 6.5 CVE-2026-108671 Anthropic
10. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any…

    CVSS 4.3 CVE-2026-108670
11. 15
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro…

    CVSS 4.3 CVE-2026-108669 Apache Software Foundation
12. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any…

    CVSS 5.4 CVE-2026-108668
13. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt…

    CVSS 4.3 CVE-2026-108667
14. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any…

    CVSS 5.4 CVE-2026-108666
15. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user…

    CVSS 4.3 CVE-2026-108665
16. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged…

    CVSS 4.3 CVE-2026-108664
17. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated…

    CVSS 4.3 CVE-2026-108663
18. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant…

    CVSS 5.4 CVE-2026-108662
19. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST…

    CVSS 6.5 CVE-2026-108661
20. 3
    CVE NVD 21d ago

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT…

    CVSS 4.3 CVE-2026-108660