# CVE-2026-111343: pig missing authorization in SysUserController.user

Source: https://junglewise.ai/threats/cve-2026-111343-pig-through-4-1-1-contains-a-missing-authorization-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111343 · Severity: medium · CVSS 4.3 · Published 2026-10-15

Pig is an RBAC (role-based access control) permission management system based on Spring Cloud and OAuth2. A missing authorization vulnerability allows any authenticated user to view other users' detailed profiles, including sensitive information like phone numbers, emails, and role assignments, by simply changing a user ID in the URL.

Technologies: [Pig-Mesh Pig](https://junglewise.ai/threats/technologies/pig). Vendors: [Pig-Mesh](https://junglewise.ai/threats/vendors/pig-mesh).

## Quick answers

**Is CVE-2026-111343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111343 being exploited in the wild.

**How severe is CVE-2026-111343?** Medium severity, with a CVSS score of 4.3, published 15 October 2026.

**Which products and versions are affected?** Pig-Mesh Pig through 4.1.1.

**Is there a fix for CVE-2026-111343?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111343 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111343?** Check whether you run Pig-Mesh Pig at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SysUserController.user endpoint (GET /admin/user/details/{id}) lacks proper authorization checks, allowing any authenticated attacker to enumerate and read profiles of other users without restriction. Low-privilege users can perform sequential ID enumeration to harvest usernames, real names, phone numbers, emails, third-party account links, and role assignments. This is a privilege escalation vulnerability that requires only valid authentication to exploit.

## Affected products

- pig-mesh pig through 4.1.1

## Timeline

- 2026-10-15: disclosed: Published to NVD

## References

- [https://github.com/pig-mesh/pig](https://github.com/pig-mesh/pig)
- [https://github.com/pig-mesh/pig/blob/v4.1.1/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysUserController.java](https://github.com/pig-mesh/pig/blob/v4.1.1/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysUserController.java)

## Related threats

- [Pig RBAC authorization bypass in SysClientController](https://junglewise.ai/threats/cve-2026-125377-pig-before-4-1-2-contains-a-missing-authorization-vulnerability)
- [pig-mesh pig SQL injection in pagination sorting](https://junglewise.ai/threats/cve-2026-115997-a-flaw-has-been-found-in-pig-mesh-pig-up-to-4-1-0-this-impacts)
- [pig authentication bypass in password reset endpoint](https://junglewise.ai/threats/cve-2026-91995-pig-authentication-bypass-in-password-reset-endpoint)
- [pig-mesh Pig code injection in pig-codegen](https://junglewise.ai/threats/cve-2026-15512-pig-mesh-pig-code-injection-in-pig-codegen)