JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController,… (CVE-2026-108648)

CVE-2026-108648 describes a missing authorization vulnerability in JeecgBoot through version 3.9.5. The vulnerability exists in the GET /sys/api/getDynamicDbSourceByCode endpoint of the SystemApiController, which does not enforce Shiro permission or role annotations. As a result, any authenticated user with low privileges can supply datasource codes via the dbSourceCode parameter to access sensitive database credentials such as JDBC URLs, usernames, and decrypted passwords in cleartext.

An attacker with any authenticated low-privileged account can exploit this vulnerability to obtain sensitive database credentials, including JDBC URLs, usernames, and cleartext passwords. This exposure can lead to unauthorized access to backend databases, potentially compromising confidentiality and integrity of stored data. The CVSS 3.1 base score is 6.5 (High), reflecting the network attack vector, low attack complexity, and high confidentiality impact without affecting integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint by implementing additional access controls or disabling the endpoint if possible. Monitor for any suspicious activity involving this API. Avoid granting unnecessary authenticated access to untrusted users.