Executive brief
JeecgBoot, a low-code development platform used to build enterprise applications, contains a security flaw in its user management component. An attacker with basic user access can manipulate specific settings to bypass security controls and potentially gain higher-level permissions. This could allow unauthorized users to access sensitive data or perform administrative actions within the system.
Technical details
A vulnerability classified as improper access control (CWE-284/CWE-266) exists in JeecgBoot versions up to 3.9.1. The flaw is located in the user.getUsername function within the /sys/user/login/setting/userEdit file of the SysUser component. By manipulating the userIdentity argument, a remote attacker with low-privileged authentication can bypass intended access restrictions to escalate privileges. The exploit has been made public. The issue is addressed in version 3.9.2, which implements stricter validation and permission checks.
Affected products
- JeecgBoot JeecgBoot up to 3.9.1
Timeline
- 2026-04-30: patched: Version 3.9.2 released.
- 2026-05-26: disclosed: Public disclosure of the vulnerability.
- 2026-05-26: advisory: NVD and VulDB advisories published.