JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any… (CVE-2026-108650)

The vulnerability in JeecgBoot up to version 3.9.5 is due to missing authorization checks in the getUserPermissionSet handler of the SystemApiController. Authenticated users with low privileges can exploit this by providing any userId to the GET /sys/api/getUserPermissionSet API endpoint, thereby reading the permission codes of other users, including those with administrative privileges. This exposure of permission sets could aid attackers in understanding and potentially escalating privileges. The CVSS 3.1 base score is 4.3 (medium), with attack vector network, low attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthorized disclosure of permission codes for any user account to an authenticated attacker. This information leak could facilitate further attacks or privilege escalation attempts by revealing the permissions assigned to other users, including administrators. There is no impact on integrity or availability reported.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected API endpoint to trusted users only and monitor for suspicious use of the getUserPermissionSet API. Implement additional authorization checks at the application level if possible.