Is CVE-2026-108887 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108887 being exploited in the wild.

How severe is CVE-2026-108887?

Medium severity, with a CVSS score of 4.3, published 11 October 2026.

Is there a fix for CVE-2026-108887?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108887 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108887?

Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108887: JeecgBoot SysCommentController missing authorization in exportXls

CVE-2026-108887 · Severity: medium · CVSS 4.3 · Published 2026-10-11

JeecgBoot is an open-source enterprise application framework with a comments module for managing user feedback on business records. The exportXls handler in SysCommentController lacks proper authorization checks, allowing any authenticated user to download a spreadsheet containing all comments in the system, including sensitive comment text and user IDs from records they cannot access. This enables unauthorized information disclosure affecting data confidentiality across all system users.

Technologies: JeecgBoot. Vendors: JeecgBoot.

Quick answers

Is CVE-2026-108887 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108887 being exploited in the wild.
How severe is CVE-2026-108887?: Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?: JeecgBoot through 3.9.5.
Is there a fix for CVE-2026-108887?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108887 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108887?: Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SysCommentController.exportXls endpoint lacks any authorization annotations (@RequiresPermissions, @RequiresRoles, @PermissionData) and performs no access control checks before exporting the entire sys_comment table. An authenticated attacker can invoke GET /sys/comment/exportXls to retrieve a workbook containing all comments across all business records, bypassing record-level access controls. The vulnerability requires authentication but no further privileges, and the service components do not validate whether the caller can access the underlying business records.

Affected products

JeecgBoot JeecgBoot through 3.9.5

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.