MEDIUM 6.5 NVD
CVE-2026-78970
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT to
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.
References
- https://github.com/jeecgboot/JeecgBoot/issues/9670
- https://github.com/jeecgboot/JeecgBoot/issues/9674
- https://github.com/jeecgboot/JeecgBoot/issues/9674
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-04 via NVD.
vulnfeed aggregates 10236 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.