Description

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T16:17:59.973Z",
  "pubdate": "2026-09-04T16:17:59.973Z",
  "executiveSummary": "JeecgBoot versions 3.9.2 and earlier are susceptible to an authorization bypass vulnerability located within the SystemApiController component. This flaw allows an authenticated attacker possessing any valid JWT token to perform unauthorized cross-authorization actions.\nThe vulnerability stems from missing fine-grained access control checks and inadequate data desensitization within sensitive API endpoints. By exploiting this flaw, a low-privileged user can enumerate and extract extensive sensitive user data from the system, including full names, telephone numbers, email addresses, employee identifiers, and role-based assignments.\nThe impact is significant, as it facilitates mass PII (Personally Identifiable Information) exfiltration, potentially leading to unauthorized data harvesting and further lateral movement within the application infrastructure. The vulnerability requires a valid authentication session, but does not necessitate specific administrative privileges, making it accessible to any registered user in the system. The risk profile is high, given the direct exposure of sensitive organizational data.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization implementation within the SystemApiController component. While the application validates the presence of a valid JWT (JSON Web Token) at the controller level, it fails to verify if the authenticated user has the necessary permissions to access specific internal user management methods.\nSpecifically, the API endpoints queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds operate under the assumption that the calling user possesses sufficient administrative authority. However, the system architecture lacks an enforcement mechanism—such as a mandatory interceptor or AOP (Aspect-Oriented Programming) advice—to validate the scope and authorization context for these sensitive queries.\nThe attack flow proceeds as follows: An attacker authenticates with the application using a standard, low-privileged user account to obtain a valid JWT. The attacker then crafts an HTTP request targeting the vulnerable endpoints within SystemApiController. Because the backend service performs an incomplete check—validating only the cryptographic integrity of the token rather than the authorization level associated with the subject—the request is processed. The controller retrieves user records from the underlying database without applying any desensitization filters. The system then returns the full data payload to the requester, exposing highly sensitive user attributes. Since the application fails to enforce fine-grained access control (FGAC) at the service or DAO (Data Access Object) layer, the attacker can iterate through IDs or usernames to perform a full system user enumeration. This bypass effectively ignores the security boundary intended to isolate administrative functions from regular user activity. The persistence of this data exposure post-exploitation is significant, as an attacker can exfiltrate the entire user directory, providing a roadmap of the organization's staff, roles, and contact information, which serves as a foundation for targeted social engineering or further privilege escalation attacks within the JeecgBoot ecosystem."
}