Executive brief
JeecgBoot is an open-source rapid application development platform commonly used to build enterprise management systems. An authenticated attacker with any valid user account can bypass authorization checks in the user query API endpoints and retrieve sensitive information about all users in the system—including real names, phone numbers, email addresses, and role definitions—that should be restricted or masked. This allows low-privilege users to harvest and compile complete user directories with personal details, posing risks to privacy and enabling social engineering attacks or account takeover attempts.
Technical details
The vulnerability is an authorization bypass and information disclosure flaw in the SystemApiController component of JeecgBoot 3.9.2 and earlier. Multiple API endpoints (queryAllUser, queryUsersByUsernames, queryUserById, queryUsersByIds, and others under /jeecg-boot/sys/api/**) lack fine-grained role and permission checks and fail to consistently apply data desensitization via SensitiveInfoUtil.handlerObject(). An authenticated attacker with any valid JWT token—even with low-privilege roles—can call these endpoints to enumerate and retrieve unmasked sensitive user data. The root cause is incomplete permission validation at the API layer and inconsistent application of data masking across batch query operations versus single-user queries. No special network access or user interaction is required beyond possessing a valid credential; the attack surface is all endpoints under the /sys/api/** path. Patch availability and timeline have not been specified in available disclosures.
Affected products
- JeecgBoot JeecgBoot 3.9.2 and earlier
Timeline
- 2026-05-30: disclosed: Initial issue #9670 opened on GitHub describing authorization bypass and SSRF vulnerabilities
- 2026-06-01: advisory: Detailed CVE submission and proof-of-concept published in issue #9674
- 2026-09-04: other: CVE-2026-78970 assigned and published to NVD