Executive brief
JeecgBoot is a low-code development platform used to build enterprise business systems. A security flaw in the user management interface allows an authenticated user to potentially discover sensitive information about other users, such as password hashes and security salts. By repeatedly testing different characters, an attacker could eventually reconstruct these secrets, which could lead to unauthorized account access or full system compromise.
Technical details
A vulnerability exists in the queryPageList function within src/main/java/org/jeecg/modules/system/controller/SysUserController.java of JeecgBoot. The QueryGenerator.initQueryWrapper() method automatically maps all fields of the SysUser entity to SQL query conditions, including sensitive fields like 'password' and 'salt'. Because these fields are not explicitly excluded from the GET request parameter binding, an authenticated attacker can perform wildcard-based fuzzy matching (e.g., password=a*) to iteratively leak password hashes and salts. This is a classic case of CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). A fix is planned for a future release, and the recommended mitigation is to manually nullify these fields in the controller before query generation.
Affected products
- JeecgBoot JeecgBoot up to 3.9.2
Timeline
- 2026-05-19: disclosed: Issue reported on GitHub repository
- 2026-06-07: advisory: CVE published and added to NVD