CVE-2026-78970: JeecgBoot authorization bypass in SystemApiController

CVE-2026-78970 · Severity: medium · CVSS 6.5 · Published 2026-09-04

JeecgBoot is an open-source rapid application development platform commonly used to build enterprise management systems. An authenticated attacker with any valid user account can bypass authorization checks in the user query API endpoints and retrieve sensitive information about all users in the system—including real names, phone numbers, email addresses, and role definitions—that should be restricted or masked. This allows low-privilege users to harvest and compile complete user directories with personal details, posing risks to privacy and enabling social engineering attacks or account takeover attempts.

Technologies: JeecgBoot. Vendors: JeecgBoot.

Quick answers

Is CVE-2026-78970 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-78970 being exploited in the wild.
How severe is CVE-2026-78970?
Medium severity, with a CVSS score of 6.5, published 4 September 2026.
Which products and versions are affected?
JeecgBoot 3.9.2 and earlier.
Is there a fix for CVE-2026-78970?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78970 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-78970?
Check whether you run JeecgBoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass and information disclosure flaw in the SystemApiController component of JeecgBoot 3.9.2 and earlier. Multiple API endpoints (queryAllUser, queryUsersByUsernames, queryUserById, queryUsersByIds, and others under /jeecg-boot/sys/api/**) lack fine-grained role and permission checks and fail to consistently apply data desensitization via SensitiveInfoUtil.handlerObject(). An authenticated attacker with any valid JWT token—even with low-privilege roles—can call these endpoints to enumerate and retrieve unmasked sensitive user data. The root cause is incomplete permission validation at the API layer and inconsistent application of data masking across batch query operations versus single-user queries. No special network access or user interaction is required beyond possessing a valid credential; the attack surface is all endpoints under the /sys/api/** path. Patch availability and timeline have not been specified in available disclosures.

Affected products

  • JeecgBoot JeecgBoot 3.9.2 and earlier

Timeline

  • 2026-05-30: disclosed: Initial issue #9670 opened on GitHub describing authorization bypass and SSRF vulnerabilities
  • 2026-06-01: advisory: Detailed CVE submission and proof-of-concept published in issue #9674
  • 2026-09-04: other: CVE-2026-78970 assigned and published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.