JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users… (CVE-2026-108677)

JeecgBoot through version 3.9.5 contains a missing authorization vulnerability (CWE-862) in the GET /sys/api/getUserByName API endpoint. This vulnerability permits low-privileged authenticated users to access any user's stored password value. The password values are encrypted using AES-CBC, but the encryption key is hard-coded and exposed via the /sys/getEncryptedString endpoint. Attackers can use this key to decrypt the password ciphertexts offline, potentially allowing them to guess administrator passwords.

An attacker with low-level authentication privileges can retrieve encrypted password data of any user, including administrators, and decrypt it using a publicly accessible hard-coded key. This exposure can lead to offline password guessing attacks against privileged accounts, potentially compromising administrative access. The vulnerability has a CVSS 3.1 base score of 6.5 (high severity), indicating a significant confidentiality impact without affecting integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious activity related to these endpoints.