CVE-2026-78970: n/a

CVE-2026-78970 describes an authorization bypass vulnerability in JeecgBoot 3.9.2 and earlier. The flaw exists in the SystemApiController component, where authenticated attackers possessing any valid JWT token can call API endpoints such as queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds. Due to missing fine-grained permission checks and incomplete data desensitization, these endpoints expose sensitive user information including real names, phone numbers, email addresses, employee numbers, and role definitions. The vulnerability is categorized under CWE-862 (Missing Authorization).

An attacker with any valid JWT token can bypass authorization controls to access sensitive personal and organizational user data. This exposure includes real names, contact details, employee identifiers, and role information, potentially leading to privacy violations and aiding further attacks. The vulnerability does not impact system integrity or availability but results in a confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious access patterns. Implement additional authorization checks and data masking as a temporary mitigation if possible.