JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows… (CVE-2026-108651)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the getRolesByUserId handler within SystemApiController. Authenticated users can exploit this by providing arbitrary userId parameters to the GET /sys/api/getRolesByUserId API endpoint, allowing them to retrieve role codes assigned to any user. This unauthorized access to role information can facilitate reconnaissance activities such as identifying privileged or administrator accounts within the system.

The impact is limited to information disclosure of user role codes. Confidentiality is partially compromised as attackers can enumerate role assignments, potentially aiding further attacks by identifying high-privilege accounts. There is no direct impact on integrity or availability. The CVSS score of 4.3 (medium severity) reflects this limited confidentiality impact with low attack complexity and low privileges required.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the GET /sys/api/getRolesByUserId endpoint to trusted users only and monitor for suspicious activity involving role enumeration attempts.