Executive brief
JeecgBoot, an AI-powered low-code development platform, contains a security vulnerability in its comment and rule management features. An authenticated user can bypass intended access controls to post or edit comments as if they were a different user, including administrators. This could lead to unauthorized data modification, identity spoofing within the system, and potential reputational damage through fraudulent communications.
Technical details
A Mass Assignment vulnerability exists in JeecgBoot up to version 3.9.1 due to missing '@RequiresPermissions' annotations and a failure to validate user-supplied identity fields against the current session context. Specifically, the endpoints '/sys/comment/add', '/sys/comment/edit', and '/sys/checkRule/add' accept and persist sensitive fields such as 'fromUserId', 'toUserId', and 'createBy' directly from the request body into the database. A remote authenticated attacker can exploit this to publish or modify comments on behalf of any other user (including 'admin') or misattribute system rule creation. The issue is resolved in version 3.9.2 by implementing proper permission checks and server-side enforcement of user identity fields.
Affected products
- JeecgBoot JeecgBoot up to 3.9.1
Timeline
- 2026-05-02: disclosed: Issue reported on GitHub
- 2026-05-11: patched: Version 3.9.2 released with security fixes
- 2026-05-26: advisory: CVE-2026-9581 published